An enterprise maintains a central data lakehouse architecture managed by Dataplex Universal Catalog, consisting of native BigQuery analytical tables and raw semi-structured data residing in Cloud Storage bucket assets. The compliance team requires an automated solution to: Continuously discover, profile, and classify sensitive personally identifiable information (PII) across both BigQuery and Cloud Storage. Enforce fine-grained column-level access controls and dynamic data masking so that non-privileged query users see masked values without altering the underlying data. Standardize policy management across all storage layers without maintaining disparate security pipelines. Which configuration strategy should the data engineering team implement to meet these governance requirements?

Upgrade Cloud Storage bucket assets in Dataplex to BigLake tables, configure Sensitive Data Protection profiling to scan and classify columns, and enforce dynamic data masking using taxonomy-based policy tags in BigQuery.: ### What BigLake and Sensitive Data Protection Integration Is **Dataplex Universal Catalog** works in tandem with **Sensitive Data Protection (Cloud DLP)** and **BigLake** to deliver unified, automated data discovery, classification, and security enforcement across heterogeneous cloud storage layers. ### How It Meets the Requirements - **Continuous Discovery and Classification**: Sensitive Data Protection continuously scans and profiles native **BigQuery tables** and **BigLake tables** to discover sensitive infoTypes (such as SSNs and credit card numbers) and auto-generates data profiles. - **Unifying Cloud Storage with BigLake**: Upgrading Cloud Storage bucket assets from standard external tables to **BigLake tables** allows Dataplex and BigQuery to enforce fine-grained access controls—such as **column-level security**, **row-level security**, and **dynamic data masking**—over external files stored in Cloud Storage. - **Dynamic Data Masking via Taxonomy Policy Tags**: Attaching **taxonomy policy tags** associated with BigQuery data masking rules ensures unauthorized users receive redacted, masked, or hashed values at query runtime while authorized users with appropriate fine-grained reader roles access the plaintext data. ### Key Advantages and Capabilities - **Consistent Security Model**: Applies identical **column-level security** and masking policies to both native BigQuery storage and Cloud Storage object files. - **Zero Data Duplication**: Preserves data in place without requiring destructive redaction or duplicate sanitized tables. - **Automated Governance**: Reduces operational overhead by leveraging automated data profiling to classify sensitive fields continuously. - **Fine-Grained IAM Control**: Grants granular de-masking permissions via IAM without modifying underlying table schemas. ### Why This Is Optimal Standard BigQuery external tables do not support column-level security or dynamic data masking. Upgrading assets to BigLake tables brings first-class governance and masking capabilities to data lakes, unifying the security posture across all data lakehouse assets.

Dataplex Sensitive Data Protection Masking Biglake | professional-cloud-data-engineer

Dataplex Sensitive Data Protection Masking Biglake

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise maintains a central data lakehouse architecture managed by Dataplex Universal Catalog, consisting of native BigQuery analytical tables and raw semi-structured data residing in Cloud Storage bucket assets. The compliance team requires an automated solution to:

Continuously discover, profile, and classify sensitive personally identifiable information (PII) across both BigQuery and Cloud Storage.
Enforce fine-grained column-level access controls and dynamic data masking so that non-privileged query users see masked values without altering the underlying data.
Standardize policy management across all storage layers without maintaining disparate security pipelines.

Which configuration strategy should the data engineering team implement to meet these governance requirements?

Upgrade Cloud Storage bucket assets in Dataplex to BigLake tables, configure Sensitive Data Protection profiling to scan and classify columns, and enforce dynamic data masking using taxonomy-based policy tags in BigQuery.

Configure Dataplex Discovery with Dataproc Metastore to manage table schemas, and apply IAM conditions at the lake level using the Dataplex Metadata Reader role to hide sensitive column schema definitions.

Grant analysts the Dataplex Data Reader role at the lake level, create VPC Service Controls perimeters around Cloud Storage, and deploy Cloud DLP inspect job triggers that publish violation alerts to Pub/Sub.

Retain standard external tables for Cloud Storage bucket assets, run scheduled Dataflow pipelines calling the Sensitive Data Protection API to rewrite files with format-preserving encryption, and distribute Cloud KMS keys to authorized users.

Professional Cloud Data Engineer

Dataplex Sensitive Data Protection Masking Biglake

Related questions