An enterprise maintains a central data lakehouse architecture managed by Dataplex Universal Catalog, consisting of native BigQuery analytical tables and raw semi-structured data residing in Cloud Storage bucket assets. The compliance team requires an automated solution to: Continuously discover, profile, and classify sensitive personally identifiable information (PII) across both BigQuery and Cloud Storage. Enforce fine-grained column-level access controls and dynamic data masking so that non-privileged query users see masked values without altering the underlying data. Standardize policy management across all storage layers without maintaining disparate security pipelines. Which configuration strategy should the data engineering team implement to meet these governance requirements?

Upgrade Cloud Storage bucket assets in Dataplex to BigLake tables, configure Sensitive Data Protection profiling to scan and classify columns, and enforce dynamic data masking using taxonomy-based policy tags in BigQuery.: What BigLake and Sensitive Data Protection Integration Is Dataplex Universal Catalog works in tandem with Sensitive Data Protection (Cloud DLP) and BigLake to deliver unified, automated data discovery, classification, and security enforcement across heterogeneous cloud storage layers. How It Meets the Requirements Continuous Discovery and Classification: Sensitive Data Protection continuously scans and profiles native BigQuery tables and BigLake tables to discover sensitive infoTypes (such as SSNs and credit card numbers) and auto-generates data profiles. Unifying Cloud Storage with BigLake: Upgrading Cloud Storage bucket assets from standard external tables to BigLake tables allows Dataplex and BigQuery to enforce fine-grained access controls—such as column-level security, row-level security, and dynamic data masking—over external files stored in Cloud Storage. Dynamic Data Masking via Taxonomy Policy Tags: Attaching taxonomy policy tags associated with BigQuery data masking rules ensures unauthorized users receive redacted, masked, or hashed values at query runtime while authorized users with appropriate fine-grained reader roles access the plaintext data. Key Advantages and Capabilities Consistent Security Model: Applies identical column-level security and masking policies to both native BigQuery storage and Cloud Storage object files. Zero Data Duplication: Preserves data in place without requiring destructive redaction or duplicate sanitized tables. Automated Governance: Reduces operational overhead by leveraging automated data profiling to classify sensitive fields continuously. Fine-Grained IAM Control: Grants granular de-masking permissions via IAM without modifying underlying table schemas. Why This Is Optimal Standard BigQuery external tables do not support column-level security or dynamic data masking. Upgrading assets to BigLake tables brings first-class governance and masking capabilities to data lakes, unifying the security posture across all data lakehouse assets.

StudyCerts

Professional Cloud Data Engineer

professional-cloud-data-engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Dataplex Sensitive Data Protection Masking Biglake

Section: Data staging, cataloging, profiling, and discovery (data governance)

An enterprise maintains a central data lakehouse architecture managed by Dataplex Universal Catalog, consisting of native BigQuery analytical tables and raw semi-structured data residing in Cloud Storage bucket assets. The compliance team requires an automated solution to:

Continuously discover, profile, and classify sensitive personally identifiable information (PII) across both BigQuery and Cloud Storage.
Enforce fine-grained column-level access controls and dynamic data masking so that non-privileged query users see masked values without altering the underlying data.
Standardize policy management across all storage layers without maintaining disparate security pipelines.

Which configuration strategy should the data engineering team implement to meet these governance requirements?

Configure Dataplex Discovery with Dataproc Metastore to manage table schemas, and apply IAM conditions at the lake level using the Dataplex Metadata Reader role to hide sensitive column schema definitions.

Retain standard external tables for Cloud Storage bucket assets, run scheduled Dataflow pipelines calling the Sensitive Data Protection API to rewrite files with format-preserving encryption, and distribute Cloud KMS keys to authorized users.

Upgrade Cloud Storage bucket assets in Dataplex to BigLake tables, configure Sensitive Data Protection profiling to scan and classify columns, and enforce dynamic data masking using taxonomy-based policy tags in BigQuery.

Grant analysts the Dataplex Data Reader role at the lake level, create VPC Service Controls perimeters around Cloud Storage, and deploy Cloud DLP inspect job triggers that publish violation alerts to Pub/Sub.

Professional Cloud Data Engineer

professional-cloud-data-engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Dataplex Sensitive Data Protection Masking Biglake

Section: Data staging, cataloging, profiling, and discovery (data governance)

Continuously discover, profile, and classify sensitive personally identifiable information (PII) across both BigQuery and Cloud Storage.
Enforce fine-grained column-level access controls and dynamic data masking so that non-privileged query users see masked values without altering the underlying data.
Standardize policy management across all storage layers without maintaining disparate security pipelines.

Which configuration strategy should the data engineering team implement to meet these governance requirements?

Explanations

What BigLake and Sensitive Data Protection Integration Is

Dataplex Universal Catalog works in tandem with Sensitive Data Protection (Cloud DLP) and BigLake to deliver unified, automated data discovery, classification, and security enforcement across heterogeneous cloud storage layers.

How It Meets the Requirements

Continuous Discovery and Classification: Sensitive Data Protection continuously scans and profiles native BigQuery tables and BigLake tables to discover sensitive infoTypes (such as SSNs and credit card numbers) and auto-generates data profiles.
Unifying Cloud Storage with BigLake: Upgrading Cloud Storage bucket assets from standard external tables to BigLake tables allows Dataplex and BigQuery to enforce fine-grained access controls—such as column-level security, row-level security, and dynamic data masking—over external files stored in Cloud Storage.
Dynamic Data Masking via Taxonomy Policy Tags: Attaching taxonomy policy tags associated with BigQuery data masking rules ensures unauthorized users receive redacted, masked, or hashed values at query runtime while authorized users with appropriate fine-grained reader roles access the plaintext data.

Key Advantages and Capabilities

Consistent Security Model: Applies identical column-level security and masking policies to both native BigQuery storage and Cloud Storage object files.
Zero Data Duplication: Preserves data in place without requiring destructive redaction or duplicate sanitized tables.
Automated Governance: Reduces operational overhead by leveraging automated data profiling to classify sensitive fields continuously.
Fine-Grained IAM Control: Grants granular de-masking permissions via IAM without modifying underlying table schemas.

Why This Is Optimal

Standard BigQuery external tables do not support column-level security or dynamic data masking. Upgrading assets to BigLake tables brings first-class governance and masking capabilities to data lakes, unifying the security posture across all data lakehouse assets.

View source documentation

Professional Cloud Data Engineer

Dataplex Sensitive Data Protection Masking Biglake

Professional Cloud Data Engineer

Dataplex Sensitive Data Protection Masking Biglake

What BigLake and Sensitive Data Protection Integration Is

How It Meets the Requirements

Key Advantages and Capabilities

Why This Is Optimal

Related questions

Dataflow Diagnostics Tab