A security engineer is configuring column-level security in BigQuery to restrict access to sensitive personal data across an analytical data warehouse. The engineer has completed the following steps: Created a taxonomy named PII_Taxonomy with a policy tag named High_Sensitivity. Updated the BigQuery table schema so that sensitive columns reference the resource name of the High_Sensitivity policy tag. Granted the BigQuery Data Viewer role at the dataset level to the general data analytics group. During validation, the engineer discovers that members of the data analytics group can still execute queries and read cleartext data from the tagged columns, even though they were never granted access to the policy tag. What action must the security engineer take to ensure that column-level access control is actively enforced?

Enable the Enforce access control setting on the taxonomy and grant the Data Catalog Fine-Grained Reader role on the policy tag to authorized principals.: ### What Taxonomy Access Control Enforcement Is **Column-level access control** in BigQuery operates through a structured four-step workflow: creating taxonomies and policy tags, associating those policy tags with table column schemas, enabling enforcement on the taxonomy, and assigning appropriate IAM permissions to the policy tags. Policy tags attached to table schemas remain inert metadata until taxonomy enforcement is explicitly turned on. ### How It Meets the Requirements - **Activating query-time authorization**: Toggling **Enforce access control** creates the underlying data policy enforcement mechanism. Once enabled, BigQuery checks whether a querying principal has fine-grained permissions on the attached policy tag whenever they query the tagged column. - **Restricting sensitive visibility**: Users with dataset-level read access (such as `roles/bigquery.dataViewer`) will receive access denied errors at query time for protected columns unless they also hold the **Data Catalog Fine-Grained Reader** (`roles/datacatalog.categoryFineGrainedReaderViewer`) role on the specific policy tag. - **Granting selective clearance**: Granting the **Data Catalog Fine-Grained Reader** role exclusively to authorized data governance or security personnel allows them to retrieve cleartext values while shielding raw data from standard analysts. ### Key Advantages and Capabilities - **Dual-layer access control**: Enforces least privilege by requiring both dataset/table read permissions and explicit policy tag permissions. - **Centralized governance**: A single policy tag taxonomy can govern columns across multiple BigQuery datasets and projects. - **Hierarchical permission inheritance**: Permissions assigned at a parent tag in a taxonomy hierarchy automatically flow down to child leaf tags. ### Why This Is Optimal This solution completes the native BigQuery column-level security lifecycle without requiring data replication, architectural redesigns, or the maintenance of custom views.

Enforce Bigquery Column Level Access Control Policy Tags | Professional Cloud Security Engineer

Enforce Bigquery Column Level Access Control Policy Tags

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A security engineer is configuring column-level security in BigQuery to restrict access to sensitive personal data across an analytical data warehouse. The engineer has completed the following steps:

Created a taxonomy named PII_Taxonomy with a policy tag named High_Sensitivity.
Updated the BigQuery table schema so that sensitive columns reference the resource name of the High_Sensitivity policy tag.
Granted the BigQuery Data Viewer role at the dataset level to the general data analytics group.

During validation, the engineer discovers that members of the data analytics group can still execute queries and read cleartext data from the tagged columns, even though they were never granted access to the policy tag.

What action must the security engineer take to ensure that column-level access control is actively enforced?

Create an authorized view in a separate dataset that excludes sensitive columns, and revoke dataset-level read permissions on the underlying table.

Define a row-level access policy on the table using a SESSION_USER() filter to restrict visible column values.

Grant the BigQuery Data Policy Admin role to the data analytics group and reapply the policy tags using a CREATE TABLE DDL statement.

Enable the Enforce access control setting on the taxonomy and grant the Data Catalog Fine-Grained Reader role on the policy tag to authorized principals.

Professional Cloud Security Engineer

Enforce Bigquery Column Level Access Control Policy Tags

Related questions