A financial services organization is building a decentralized data mesh architecture on Google Cloud. Multiple domain teams need to expose curated analytical data products to downstream business analysts across the enterprise. The enterprise architecture board has defined the following technical and regulatory constraints: Downstream business analysts must query aggregated business metrics and sanitized virtual tables without having direct read permissions to the underlying sensitive base datasets. The security and compliance teams require minimal administrative overhead and must avoid managing individual view authorizations as dozens of new analytical views are published. Data domain infrastructure deployments must prevent configuration drift using infrastructure as code (IaC) templates. Which technical requirement and access pattern should the data engineering team implement to satisfy these business objectives?

Create curated views inside a dedicated dataset and configure that dataset as a BigQuery Authorized Dataset with access to the underlying source dataset, provisioning the resources via Terraform modules.: ### What BigQuery Authorized Datasets are **BigQuery Authorized Datasets** allow data product owners to authorize an entire dataset containing multiple views or user-defined functions (UDFs) to access source data stored in a separate, restricted dataset. This enables domain teams to publish virtual consumption interfaces without granting consumers direct access to raw, underlying data. ### How it meets the requirements - **Sanitized virtual tables without base table permissions**: Analysts are granted read permissions (`roles/bigquery.dataViewer`) only on the consumption dataset containing the views. When analysts execute queries against these views, the authorization is evaluated via the dataset-level authorization grant, allowing access to the underlying base tables without exposing the underlying base tables directly. - **Minimal administrative overhead at scale**: Authorizing an entire dataset automatically extends authorization to any new view created within that dataset. This eliminates the need to configure and maintain authorization grants for each view individually as new data products are deployed. - **Immutable infrastructure without configuration drift**: Composable **Terraform modules** allow the platform team to codify the dataset creation, view definitions, and IAM authorization policies into declarative source-controlled templates. ### Key advantages - **Decentralized governance**: Simplifies consumption interfaces across independent data mesh domains. - **Scalable authorization**: Automatically applies authorization to newly created views without manual intervention. - **Zero-trust data isolation**: Guarantees consumers only see permitted transformations, satisfying strict financial regulatory constraints. - **IaC reproducibility**: Prevents configuration drift and enforces baseline security guardrails during deployment. ### Why this is optimal Using **Authorized Datasets** combined with **Terraform modules** provides the exact abstraction layer required for decentralized data product consumption interfaces while keeping management overhead low and maintaining rigorous access boundaries.

Implement Bigquery Authorized Datasets Data Mesh | professional-cloud-data-engineer

Implement Bigquery Authorized Datasets Data Mesh

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A financial services organization is building a decentralized data mesh architecture on Google Cloud. Multiple domain teams need to expose curated analytical data products to downstream business analysts across the enterprise.

The enterprise architecture board has defined the following technical and regulatory constraints:

Downstream business analysts must query aggregated business metrics and sanitized virtual tables without having direct read permissions to the underlying sensitive base datasets.
The security and compliance teams require minimal administrative overhead and must avoid managing individual view authorizations as dozens of new analytical views are published.
Data domain infrastructure deployments must prevent configuration drift using infrastructure as code (IaC) templates.

Which technical requirement and access pattern should the data engineering team implement to satisfy these business objectives?

Create curated views inside a dedicated dataset and configure that dataset as a BigQuery Authorized Dataset with access to the underlying source dataset, provisioning the resources via Terraform modules.

Create standalone BigQuery Authorized Views for each data product and assign individual view permissions directly to downstream analyst IAM accounts using manual Cloud Console operations.

Grant analysts the BigQuery Data Viewer role on the base dataset and apply Cloud KMS customer-managed encryption keys (CMEK) to decrypt only the aggregated columns.

Export base data to Cloud Storage as CSV files daily, trigger Dataflow batch pipelines to create aggregates, and write the outputs into separate consumer projects without dataset authorization.

Professional Cloud Data Engineer

Implement Bigquery Authorized Datasets Data Mesh

Related questions