basic roles on Associate Data Practitioner

What you can expect on the exam

Scope comparison with predefined roles. Expect to differentiate basic roles, which provide broad administrative access across resources, from predefined roles that deliver granular permissions scoped to specific tasks.
Technical limits and permission exclusions. Be ready to recognize operational limits of legacy basic roles, including the inability to attach conditional bindings and the omission of select administrative permissions from the Owner role.
Granular asset and dataset assignment risks. You may need to identify why applying basic roles like Owner at granular dataset levels is discouraged due to excessive permissions and a lack of table-level access.
Core legacy role hierarchy. Know how legacy basic roles such as Editor and Owner build upon one another to grant cumulative permissions across an entire project rather than targeting individual services.

Where this appears on the exam

2 subdomains in 1 of 4 domains

Section 4
Data Management
1. 4.1Configure access control and governance
  - Establish the principles of least privileged access by using Identity and Access Management (IAM)
  - Differentiate between basic roles, predefined roles, and permissions for data services (e.g., BigQuery, Cloud Storage)

Identity and Access ManagementService predefined roleConcept Data StudioService IAM rolesConcept IAM roleConcept Backup and DRService Google Cloud StorageService

basic rolesConcept

custom rolesConcept predefined rolesConcept BigQueryService

Points to what builds on itWorks with or alternative toHover or tap a line to see what connects the two

basic roles is part of Identity and Access Management From the official documentation: “IAM provides three types of roles: [predefined roles](#predefined-compute-engine-roles), [basic roles](#basic-iam-roles), and [custom roles](/iam/docs/understanding-custom-roles).”
basic roles is an alternative to predefined roles From the official documentation: “To keep your project and clusters secure, use [predefined Roles](#predefined) whenever possible.”
basic roles is part of Data Studio From the official documentation: “The following basic roles are available to all Data Studio users.”
basic roles is an alternative to predefined role From the official documentation: “Instead, grant the most limited predefined roles or custom roles that meet your needs.”
custom roles is an alternative to predefined roles From the official documentation: “Generally, we recommend that you [use predefined roles](/iam/docs/choose-predefined-roles) instead of basic or custom roles.”
BigQuery works with Data Studio From the official documentation: “Select the BigQuery [connector](/data-studio/connector).”
custom roles is an alternative to predefined role From the official documentation: “Consolidate multiple predefined roles into fewer custom roles to reduce the space consumed.”
BigQuery is an alternative to Google Cloud Storage From the official documentation: “The training data can be either a CSV file in Cloud Storage or a table in BigQuery.”
IAM role is part of Identity and Access Management From the official documentation: “This page explains the [Identity and Access Management](/iam) roles that are available for the Cloud Billing APIs.”
BigQuery works with Google Cloud Storage From the official documentation: “Load Cloud Storage data into BigQuery”
IAM roles is part of Identity and Access Management From the official documentation: “IAM roles give the principals permissions to perform tasks on your App Topology resources.”
BigQuery works with Identity and Access Management From the official documentation: “BigQuery uses Identity and Access Management (IAM) for authorization.”
custom roles is part of IAM roles From the official documentation: “This requirement applies to both [predefined roles](/iam/docs/roles-permissions) and [custom roles](/iam/docs/roles-overview#custom).”
custom roles is part of Identity and Access Management From the official documentation: “To support this, IAM offers [custom roles](/iam/docs/creating-custom-roles).”
predefined roles is part of IAM roles From the official documentation: “This requirement applies to both [predefined roles](/iam/docs/roles-permissions) and [custom roles](/iam/docs/roles-overview#custom).”
Backup and DR works with BigQuery From the official documentation: “Backup and DR integrates with Cloud Monitoring, Cloud Logging, and BigQuery services and provides the following benefits:”
Backup and DR works with Data Studio From the official documentation: “This page explains how to view Backup and DR prebuilt reports in Data Studio for vaulted backups.”
Backup and DR depends on Identity and Access Management From the official documentation: “To access Backup and DR, each user needs a Google Account that has been added to a Google Cloud project, folder, or organization as a principal with an Identity and Access Management role that allows access to the Google Cloud console.”
Backup and DR works with Identity and Access Management From the official documentation: “The Google Cloud-native Backup and DR Service integrates with the Google Cloud ecosystem, including simplified sign-on via SSO, seamless integration with Identity and Access Management (IAM), Cloud Logging, Cloud Monitoring, Key Management, and more.”
Data Studio works with Google Cloud Storage From the official documentation: “All the data you upload via Data Studio is stored in Google Cloud Storage.”
Data Studio depends on Identity and Access Management From the official documentation: “Access to Data Studio assets (reports and data sources) is based on the Google Cloud Identity and Access Management (IAM) system.”
IAM role secures BigQuery From the official documentation: “You can use predefined and custom IAM roles to give principals the required access to BigQuery resources.”
Identity and Access Management secures BigQuery From the official documentation: “Security in BigQuery is intrinsically linked to [Identity and Access Management (IAM)](/iam/docs/overview) in Google Cloud.”
Identity and Access Management configures Google Cloud Storage From the official documentation: “Grant permission for the service account to list and view files in the bucket: ```bash gcloud storage buckets add-iam-policy-binding gs://${PROJECT_ID}-bucket/ \ --member=serviceAccount:sa-test-app-team-x@${PROJECT_ID}.iam.gserviceaccount.com \ --role=roles/storage.objectViewer…”
Identity and Access Management secures Google Cloud Storage From the official documentation: “These modifications to that file define a second backup repository in a Cloud Storage bucket, accessed through Identity and Access Management (IAM).”
predefined role is part of Identity and Access Management From the official documentation: “To make it easier to give these users the permissions that they need, Identity and Access Management (IAM) offers predefined roles that are designed for specific job functions.”
predefined roles is part of IAM role From the official documentation: “You can use the following types of roles in IAM to grant access to BigQuery resources: - [**Predefined roles**](/iam/docs/roles-overview#predefined) are managed by Google Cloud and support common use cases and access control patterns.”
predefined roles is part of Identity and Access Management From the official documentation: “There are three types of roles in IAM: - **Predefined roles** provide granular access for a specific service and are managed by Google Cloud.”

basic roles

What you can expect on the exam

Where this appears on the exam

How learners score on this topic

basic roles

What you can expect on the exam

Where this appears on the exam

How learners score on this topic

What you can expect on the exam

Where this appears on the exam

Related topics

How learners score on this topic

What you can expect on the exam

Where this appears on the exam

Related topics

How learners score on this topic