An enterprise is designing a decentralized data mesh platform across multiple Google Cloud projects. The architecture requires establishing independent logical data domains, cataloging technical and business metadata, and enforcing standardized governance. The design must satisfy the following technical requirements: Organize distributed Cloud Storage buckets and BigQuery datasets across different projects into logical domain boundaries without copying or moving the underlying storage. Apply consistent security and governance policies to cohesive data product subgroups within each domain. Classify and enforce fine-grained column-level access control and data masking on sensitive fields across analytical assets. Which architectural strategy should the data engineering team implement using Dataplex and Dataplex Catalog?

Create a Dataplex lake for each business domain, organize domain data products into Dataplex zones, register multi-project BigQuery datasets and Cloud Storage buckets as assets, and apply Policy Taxonomies with Policy Tags for column-level data masking and access control.: ### What Dataplex Lakes, Zones, and Policy Taxonomies Are **Dataplex** (and Dataplex Universal Catalog) provides an intelligent data fabric that lets organizations build logical, decentralized data domains (data mesh) while maintaining centralized governance, discovery, and access management. Within Dataplex: - **Lakes** represent logical data domains (such as Sales, Supply Chain, or Product). - **Zones** represent sub-domains or distinct data products within a lake, grouping related storage resources to apply uniform governance. - **Assets** map directly to underlying physical storage entities (**BigQuery datasets** and **Cloud Storage buckets**) residing in the same or different Google Cloud projects. - **Policy Taxonomies and Policy Tags** provide column-level access control and dynamic data masking across BigQuery tables. ### How It Meets the Requirements - **Logical multi-project organization without moving data**: Dataplex lakes and zones allow referencing Cloud Storage buckets and BigQuery datasets located across multiple Google Cloud projects without physically replicating or moving data. - **Cohesive data product governance**: Creating **Dataplex zones** enables data domain teams to group associated assets into data products and attach consistent access, discovery, and data management policies across all resources in that zone. - **Column-level security and data masking**: Defining **Policy Taxonomies** with hierarchical **Policy Tags** in Dataplex Catalog allows security administrators to enforce column-level access permissions and data masking rules (e.g., hash, null, or default masking) on sensitive fields uniformly. ### Key Advantages and Capabilities - **Zero Data Movement**: Logical abstraction unifies storage across multiple projects without operational overhead or data duplication costs. - **Centralized Metadata & Policy Management**: Tag templates and taxonomies standardize technical and business metadata across all domain boundaries. - **Granular Security Controls**: Combines zone-level IAM inheritance with column-level policy tag access enforcement. - **Integrated Discovery**: All assets registered in Dataplex lakes are automatically cataloged and searchable via Dataplex Universal Catalog. ### Why This Is Optimal This approach aligns with Google Cloud recommended architectures for data mesh and distributed governance. It decouples physical data location from logical domain ownership while utilizing native, scalable constructs for centralized policy administration.

Dataplex Data Mesh Governance Catalog Design | professional-cloud-data-engineer

Dataplex Data Mesh Governance Catalog Design

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is designing a decentralized data mesh platform across multiple Google Cloud projects. The architecture requires establishing independent logical data domains, cataloging technical and business metadata, and enforcing standardized governance.

The design must satisfy the following technical requirements:

Organize distributed Cloud Storage buckets and BigQuery datasets across different projects into logical domain boundaries without copying or moving the underlying storage.
Apply consistent security and governance policies to cohesive data product subgroups within each domain.
Classify and enforce fine-grained column-level access control and data masking on sensitive fields across analytical assets.

Which architectural strategy should the data engineering team implement using Dataplex and Dataplex Catalog?

Create a single Dataplex lake per Google Cloud organization, attach each project's storage resources to multiple zones simultaneously, and deploy Cloud KMS customer-managed encryption keys (CMEK) to redact sensitive column values.

Create a Dataplex lake for each business domain, register individual BigQuery tables and Cloud Storage objects as Dataplex assets, and assign Catalog Tag Templates with public read permissions to enforce column data masking.

Create a Dataplex lake for each business domain, organize domain data products into Dataplex zones, register multi-project BigQuery datasets and Cloud Storage buckets as assets, and apply Policy Taxonomies with Policy Tags for column-level data masking and access control.

Create separate BigQuery datasets in a single centralized project, configure BigLake external tables pointing to all Cloud Storage buckets, and use authorized views for column masking and domain separation.

Professional Cloud Data Engineer

Dataplex Data Mesh Governance Catalog Design

Related questions