An enterprise is centralizing sensitive customer transaction data from multiple business units into a shared BigQuery data warehouse. The data engineering and security teams must implement a robust security architecture that satisfies the following requirements: Data Exfiltration Mitigation: Prevent unauthorized movement, copying, or API-based access to the BigQuery datasets from outside the organization or across unapproved projects. Tenant & Regional Isolation: Ensure analysts can only query table rows that match their specific geographic region without creating and managing separate physical tables or authorized views for every team. Field-Level Confidentiality: Automatically mask sensitive columns (such as credit card numbers and credit limits) for standard analysts, while allowing authorized compliance officers with explicit fine-grained permissions to view the cleartext data. Which combination of Google Cloud security mechanisms should the team implement?

Enclose the BigQuery storage and compute projects within VPC Service Controls perimeters, define BigQuery Row-Level Security policies filtered by region, and implement policy tags with dynamic data masking and the Fine-Grained Reader role.: What the solution is This architecture combines VPC Service Controls, BigQuery Row-Level Security (RLS), and BigQuery Column-Level Security using Policy Tags and Dynamic Data Masking to establish end-to-end context-aware security and fine-grained data access. How it meets each requirement Data Exfiltration Mitigation: VPC Service Controls establishes a logical security perimeter around Google-managed BigQuery service APIs, blocking data egress, unauthorized copying, and API access originating from outside the perimeter or from unapproved projects/credentials. Tenant & Regional Isolation: BigQuery Row-Level Security applies SQL filter predicates (e.g., WHERE region = 'APAC') directly to the base table based on user group membership (GRANT TO), avoiding the operational maintenance and scaling limits of creating separate tables or hundreds of authorized views. Field-Level Confidentiality: Categorizing sensitive fields with Data Catalog policy tags and attaching Dynamic Data Masking rules automatically redacts or obfuscates column values for general analysts during query runtime, while users granted the Fine-Grained Reader (roles/datacatalog.categoryFineGrainedReader) role can view unmasked cleartext values. Key advantages and capabilities Multi-layered defense: Secures both the network/API transport layer (via perimeter isolation) and the data presentation layer (via column and row policies). Centralized governance: Eliminates data duplication and schema divergence by maintaining a single unified fact table. Native runtime evaluation: Masking and row filtering execute dynamically at query time without altering the underlying raw data storage. Why this is optimal This approach aligns with Google Cloud security best practices by enforcing the principle of least privilege, zero-trust network boundaries, and scalable fine-grained access controls without administrative overhead.

StudyCerts

Professional Cloud Data Engineer

professional-cloud-data-engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Bigquery Fine Grained Access Vpc Service Controls

Section: Identity and Access Management (e.g., Cloud IAM and organization policies)

An enterprise is centralizing sensitive customer transaction data from multiple business units into a shared BigQuery data warehouse. The data engineering and security teams must implement a robust security architecture that satisfies the following requirements:

Data Exfiltration Mitigation: Prevent unauthorized movement, copying, or API-based access to the BigQuery datasets from outside the organization or across unapproved projects.
Tenant & Regional Isolation: Ensure analysts can only query table rows that match their specific geographic region without creating and managing separate physical tables or authorized views for every team.
Field-Level Confidentiality: Automatically mask sensitive columns (such as credit card numbers and credit limits) for standard analysts, while allowing authorized compliance officers with explicit fine-grained permissions to view the cleartext data.

Which combination of Google Cloud security mechanisms should the team implement?

Establish IAM Conditions restricting dataset access based on request IP attributes, export partitioned data extracts to region-specific Cloud Storage buckets, and use Sensitive Data Protection to delete sensitive columns.

Deploy Private Google Access with Cloud Armor security policies, generate authorized views for each geographic region, and encrypt the entire dataset with Customer-Managed Encryption Keys (CMEK).

Configure VPC firewall egress rules targeting BigQuery endpoints, create materialized subset tables clustered by region, and apply client-side AEAD encryption to sensitive columns.

Enclose the BigQuery storage and compute projects within VPC Service Controls perimeters, define BigQuery Row-Level Security policies filtered by region, and implement policy tags with dynamic data masking and the Fine-Grained Reader role.

Professional Cloud Data Engineer

professional-cloud-data-engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Bigquery Fine Grained Access Vpc Service Controls

Section: Identity and Access Management (e.g., Cloud IAM and organization policies)

Data Exfiltration Mitigation: Prevent unauthorized movement, copying, or API-based access to the BigQuery datasets from outside the organization or across unapproved projects.
Tenant & Regional Isolation: Ensure analysts can only query table rows that match their specific geographic region without creating and managing separate physical tables or authorized views for every team.
Field-Level Confidentiality: Automatically mask sensitive columns (such as credit card numbers and credit limits) for standard analysts, while allowing authorized compliance officers with explicit fine-grained permissions to view the cleartext data.

Which combination of Google Cloud security mechanisms should the team implement?

Deploy Private Google Access with Cloud Armor security policies, generate authorized views for each geographic region, and encrypt the entire dataset with Customer-Managed Encryption Keys (CMEK).

Configure VPC firewall egress rules targeting BigQuery endpoints, create materialized subset tables clustered by region, and apply client-side AEAD encryption to sensitive columns.

Explanations

What the solution is

This architecture combines VPC Service Controls, BigQuery Row-Level Security (RLS), and BigQuery Column-Level Security using Policy Tags and Dynamic Data Masking to establish end-to-end context-aware security and fine-grained data access.

How it meets each requirement

Data Exfiltration Mitigation: VPC Service Controls establishes a logical security perimeter around Google-managed BigQuery service APIs, blocking data egress, unauthorized copying, and API access originating from outside the perimeter or from unapproved projects/credentials.
Tenant & Regional Isolation: BigQuery Row-Level Security applies SQL filter predicates (e.g., WHERE region = 'APAC') directly to the base table based on user group membership (GRANT TO), avoiding the operational maintenance and scaling limits of creating separate tables or hundreds of authorized views.
Field-Level Confidentiality: Categorizing sensitive fields with Data Catalog policy tags and attaching Dynamic Data Masking rules automatically redacts or obfuscates column values for general analysts during query runtime, while users granted the Fine-Grained Reader (roles/datacatalog.categoryFineGrainedReader) role can view unmasked cleartext values.

Key advantages and capabilities

Multi-layered defense: Secures both the network/API transport layer (via perimeter isolation) and the data presentation layer (via column and row policies).
Centralized governance: Eliminates data duplication and schema divergence by maintaining a single unified fact table.
Native runtime evaluation: Masking and row filtering execute dynamically at query time without altering the underlying raw data storage.

Why this is optimal

This approach aligns with Google Cloud security best practices by enforcing the principle of least privilege, zero-trust network boundaries, and scalable fine-grained access controls without administrative overhead.

View source documentation

Professional Cloud Data Engineer

Bigquery Fine Grained Access Vpc Service Controls

Professional Cloud Data Engineer

Bigquery Fine Grained Access Vpc Service Controls

What the solution is

How it meets each requirement

Key advantages and capabilities

Why this is optimal

Related questions