Your organization manages an enterprise analytics warehouse in BigQuery containing tables with sensitive personally identifiable information (PII), such as government identification numbers and contact details. You need to implement a scalable, fine-grained access control architecture that enforces column-level security. The solution must satisfy the following requirements: General data analysts must be able to query tables and view non-sensitive columns without being able to view or query restricted PII fields. Compliance officers must be explicitly granted access to query and view raw PII fields. Classification structures must support hierarchical inheritance across multiple data classes for simplified governance. Which strategy should you implement?

Create a hierarchical taxonomy with policy tags, assign policy tags to sensitive columns via schema annotations, enforce access control on the taxonomy, and grant compliance officers the Data Catalog Fine-Grained Reader role on the appropriate policy tags while granting analysts standard BigQuery dataset permissions.: ### What BigQuery Column-Level Access Control with Policy Tags is **BigQuery column-level security** provides fine-grained access control to sensitive columns using **policy tags** within a hierarchical taxonomy. This mechanism verifies user access privileges at query time, preventing unauthorized identities from querying, projecting, or viewing sensitive column values while still allowing them to interact with unrestricted columns in the same table. ### How it meets the requirements - **Column-level security enforcement**: Policy tags are attached directly to sensitive columns (such as government IDs and SSNs) via table schema annotations. When access control is enforced on the taxonomy, BigQuery automatically restricts column access. - **Access separation**: Column-level access is enforced *in addition* to standard **BigQuery dataset permissions**. General data analysts receive dataset-level access (such as `roles/bigquery.dataViewer`) to query the table, but because they lack policy tag permissions, BigQuery blocks them from reading or filtering on protected columns. Compliance officers are granted the **Data Catalog Fine-Grained Reader** (`roles/datacatalog.fineGrainedReader`) role on the specific policy tags, allowing them to read raw PII values. - **Hierarchical classification**: Structuring policy tags in a **hierarchical tree** (e.g., High, Medium, Low tiers) allows permissions granted at a parent policy tag level to inherit down to leaf policy tags, streamlining access management across dozens of columns. ### Key advantages and capabilities - **Query-time evaluation**: Enforces granular access at execution time without requiring data duplication or manual SQL query filtering. - **Centralized taxonomy**: Allows centralized governance across multiple BigQuery tables and datasets using a unified classification taxonomy. - **Dual authorization model**: Requires both dataset-level reader access and fine-grained policy tag permissions for defense-in-depth. - **Seamless schema updates**: Can be applied via the Google Cloud console, the `bq` CLI tool (`bq update`), or the `tables.patch` API method. ### Why this is optimal This solution provides native, scalable access control without needing to build and maintain separate views or duplicate pipelines for different user roles. By using hierarchical taxonomies and the **Data Catalog Fine-Grained Reader** role, access governance remains maintainable and auditable as the data footprint grows.

Enforce Bigquery Column Level Security Pii Policy Tags | professional-cloud-data-engineer

Enforce Bigquery Column Level Security Pii Policy Tags

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your organization manages an enterprise analytics warehouse in BigQuery containing tables with sensitive personally identifiable information (PII), such as government identification numbers and contact details. You need to implement a scalable, fine-grained access control architecture that enforces column-level security.

The solution must satisfy the following requirements:

General data analysts must be able to query tables and view non-sensitive columns without being able to view or query restricted PII fields.
Compliance officers must be explicitly granted access to query and view raw PII fields.
Classification structures must support hierarchical inheritance across multiple data classes for simplified governance.

Which strategy should you implement?

Create individual authorized views for every analyst group that exclude sensitive columns, remove all dataset permissions from the underlying tables, and manage column access solely through authorized view permissions.

Declare primary and foreign key constraints on the sensitive columns in BigQuery, and configure Cloud Armor authorization policies based on VM tags to restrict query results at the network layer.

Define policy tags within a flat taxonomy, assign the policy tags to columns using standard GoogleSQL CREATE TABLE DDL statements, and grant compliance officers the BigQuery Data Viewer role while granting analysts the Data Catalog Policy Tag Admin role.

Create a hierarchical taxonomy with policy tags, assign policy tags to sensitive columns via schema annotations, enforce access control on the taxonomy, and grant compliance officers the Data Catalog Fine-Grained Reader role on the appropriate policy tags while granting analysts standard BigQuery dataset permissions.

Professional Cloud Data Engineer

Enforce Bigquery Column Level Security Pii Policy Tags

Related questions