Your organization manages an enterprise analytics warehouse in BigQuery containing tables with sensitive personally identifiable information (PII), such as government identification numbers and contact details. You need to implement a scalable, fine-grained access control architecture that enforces column-level security. The solution must satisfy the following requirements: General data analysts must be able to query tables and view non-sensitive columns without being able to view or query restricted PII fields. Compliance officers must be explicitly granted access to query and view raw PII fields. Classification structures must support hierarchical inheritance across multiple data classes for simplified governance. Which strategy should you implement?

Create a hierarchical taxonomy with policy tags, assign policy tags to sensitive columns via schema annotations, enforce access control on the taxonomy, and grant compliance officers the Data Catalog Fine-Grained Reader role on the appropriate policy tags while granting analysts standard BigQuery dataset permissions.: What BigQuery Column-Level Access Control with Policy Tags is BigQuery column-level security provides fine-grained access control to sensitive columns using policy tags within a hierarchical taxonomy. This mechanism verifies user access privileges at query time, preventing unauthorized identities from querying, projecting, or viewing sensitive column values while still allowing them to interact with unrestricted columns in the same table. How it meets the requirements Column-level security enforcement: Policy tags are attached directly to sensitive columns (such as government IDs and SSNs) via table schema annotations. When access control is enforced on the taxonomy, BigQuery automatically restricts column access. Access separation: Column-level access is enforced in addition to standard BigQuery dataset permissions. General data analysts receive dataset-level access (such as roles/bigquery.dataViewer) to query the table, but because they lack policy tag permissions, BigQuery blocks them from reading or filtering on protected columns. Compliance officers are granted the Data Catalog Fine-Grained Reader (roles/datacatalog.fineGrainedReader) role on the specific policy tags, allowing them to read raw PII values. Hierarchical classification: Structuring policy tags in a hierarchical tree (e.g., High, Medium, Low tiers) allows permissions granted at a parent policy tag level to inherit down to leaf policy tags, streamlining access management across dozens of columns. Key advantages and capabilities Query-time evaluation: Enforces granular access at execution time without requiring data duplication or manual SQL query filtering. Centralized taxonomy: Allows centralized governance across multiple BigQuery tables and datasets using a unified classification taxonomy. Dual authorization model: Requires both dataset-level reader access and fine-grained policy tag permissions for defense-in-depth. Seamless schema updates: Can be applied via the Google Cloud console, the bq CLI tool (bq update), or the tables.patch API method. Why this is optimal This solution provides native, scalable access control without needing to build and maintain separate views or duplicate pipelines for different user roles. By using hierarchical taxonomies and the Data Catalog Fine-Grained Reader role, access governance remains maintainable and auditable as the data footprint grows.

StudyCerts

Professional Cloud Data Engineer

professional-cloud-data-engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Enforce Bigquery Column Level Security Pii Policy Tags

Section: Privacy (e.g., strategies to handle personally identifiable information)

Your organization manages an enterprise analytics warehouse in BigQuery containing tables with sensitive personally identifiable information (PII), such as government identification numbers and contact details. You need to implement a scalable, fine-grained access control architecture that enforces column-level security.

The solution must satisfy the following requirements:

General data analysts must be able to query tables and view non-sensitive columns without being able to view or query restricted PII fields.
Compliance officers must be explicitly granted access to query and view raw PII fields.
Classification structures must support hierarchical inheritance across multiple data classes for simplified governance.

Which strategy should you implement?

Declare primary and foreign key constraints on the sensitive columns in BigQuery, and configure Cloud Armor authorization policies based on VM tags to restrict query results at the network layer.

Create individual authorized views for every analyst group that exclude sensitive columns, remove all dataset permissions from the underlying tables, and manage column access solely through authorized view permissions.

Create a hierarchical taxonomy with policy tags, assign policy tags to sensitive columns via schema annotations, enforce access control on the taxonomy, and grant compliance officers the Data Catalog Fine-Grained Reader role on the appropriate policy tags while granting analysts standard BigQuery dataset permissions.

Define policy tags within a flat taxonomy, assign the policy tags to columns using standard GoogleSQL CREATE TABLE DDL statements, and grant compliance officers the BigQuery Data Viewer role while granting analysts the Data Catalog Policy Tag Admin role.

Professional Cloud Data Engineer

professional-cloud-data-engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Enforce Bigquery Column Level Security Pii Policy Tags

Section: Privacy (e.g., strategies to handle personally identifiable information)

The solution must satisfy the following requirements:

General data analysts must be able to query tables and view non-sensitive columns without being able to view or query restricted PII fields.
Compliance officers must be explicitly granted access to query and view raw PII fields.
Classification structures must support hierarchical inheritance across multiple data classes for simplified governance.

Which strategy should you implement?

Declare primary and foreign key constraints on the sensitive columns in BigQuery, and configure Cloud Armor authorization policies based on VM tags to restrict query results at the network layer.

Explanations

What BigQuery Column-Level Access Control with Policy Tags is

BigQuery column-level security provides fine-grained access control to sensitive columns using policy tags within a hierarchical taxonomy. This mechanism verifies user access privileges at query time, preventing unauthorized identities from querying, projecting, or viewing sensitive column values while still allowing them to interact with unrestricted columns in the same table.

How it meets the requirements

Column-level security enforcement: Policy tags are attached directly to sensitive columns (such as government IDs and SSNs) via table schema annotations. When access control is enforced on the taxonomy, BigQuery automatically restricts column access.
Access separation: Column-level access is enforced in addition to standard BigQuery dataset permissions. General data analysts receive dataset-level access (such as roles/bigquery.dataViewer) to query the table, but because they lack policy tag permissions, BigQuery blocks them from reading or filtering on protected columns. Compliance officers are granted the Data Catalog Fine-Grained Reader (roles/datacatalog.fineGrainedReader) role on the specific policy tags, allowing them to read raw PII values.
Hierarchical classification: Structuring policy tags in a hierarchical tree (e.g., High, Medium, Low tiers) allows permissions granted at a parent policy tag level to inherit down to leaf policy tags, streamlining access management across dozens of columns.

Key advantages and capabilities

Query-time evaluation: Enforces granular access at execution time without requiring data duplication or manual SQL query filtering.
Centralized taxonomy: Allows centralized governance across multiple BigQuery tables and datasets using a unified classification taxonomy.
Dual authorization model: Requires both dataset-level reader access and fine-grained policy tag permissions for defense-in-depth.
Seamless schema updates: Can be applied via the Google Cloud console, the bq CLI tool (bq update), or the tables.patch API method.

Why this is optimal

This solution provides native, scalable access control without needing to build and maintain separate views or duplicate pipelines for different user roles. By using hierarchical taxonomies and the Data Catalog Fine-Grained Reader role, access governance remains maintainable and auditable as the data footprint grows.

View source documentation

Professional Cloud Data Engineer

Enforce Bigquery Column Level Security Pii Policy Tags

Professional Cloud Data Engineer

Enforce Bigquery Column Level Security Pii Policy Tags

What BigQuery Column-Level Access Control with Policy Tags is

How it meets the requirements

Key advantages and capabilities

Why this is optimal

Related questions