An enterprise publishes shared data listings using BigQuery Analytics Hub. A subscriber team in caller project analytics-subscriber (Project R) has subscribed to a listing and provisioned a linked dataset in project subscriber-warehouse (Project L). The underlying shared dataset contains views in project subscriber-warehouse that reference underlying base tables hosted in project source-storage (Project V). Each project resides in a separate, isolated VPC Service Controls perimeter. Queries executed by analysts in Project R against the linked dataset views are currently failing due to perimeter violations. Which VPC Service Controls ingress and egress rules must you configure to allow users in Project R to query the views while maintaining perimeter security across all projects?

Configure egress rules in Project R for Projects L and V; configure an ingress rule in Project L for Project R and an egress rule for Project V; and configure an egress rule in Project V for Project L and an ingress rule for Project R.: What the VPC Service Controls Configuration Is VPC Service Controls allows organizations to establish fine-grained security perimeters around Google Cloud resources, including BigQuery Analytics Hub, to prevent data exfiltration. When BigQuery queries span multiple perimeters across caller projects, linked datasets, and underlying source datasets containing base tables, specific directional ingress and egress rules must be defined to bridge perimeter boundaries. How It Meets the Requirements When an analyst queries a view in a linked dataset where the view, caller, and base tables are distributed across separate perimeters: Caller Project (Project R): Requires an egress rule targeting Project L (to submit query requests against the linked dataset) and an egress rule targeting Project V (to read data processed from the underlying base tables). Linked Dataset Project (Project L): Requires an ingress rule allowing access from Project R (to receive the query execution request) and an egress rule targeting Project V (to resolve and reference the base tables). Base Table Source Project (Project V): Requires an egress rule targeting Project L (to return table schema metadata) and an ingress rule allowing access from Project R (to permit the query engine in the caller context to process the underlying data). Key Advantages Precision Access Control: Enables cross-project, cross-perimeter Analytics Hub data sharing without dismantling perimeter boundaries. Prevents Exfiltration: Limits communication pathways strictly between designated calling, linking, and storage projects. Maintains Source Data Control: Leaves source table ownership intact in Project V while allowing Project L to serve as an analytics projection. Why This Is Optimal This configuration accurately aligns with the multi-perimeter architecture rules required by Analytics Hub when views and underlying base tables reside in separate projects and service perimeters.

Analytics Hub Vpc Service Controls Linked Views | Professional Cloud Data Engineer

AdvancedProfessional Cloud Data Engineer

A retail enterprise wants to establish a decentralized data-sharing architecture to publish curated demand-forecasting datasets and file assets to hundreds of vendor partners and internal domain teams. The data architecture team needs to implement a solution that fulfills the following operational and financial requirements: Provide centralized discoverability and rich metadata annotations across all published SQL datasets and storage filesets. Enforce a cost-sharing model where the publishing team pays only for underlying data storage, while consumers incur the compute and query execution costs. Eliminate unnecessary data replication and maintenance overhead across consumer projects. Which combination of Google Cloud services and configurations should the enterprise implement?

Publishing datasets

AdvancedProfessional Cloud Data Engineer

Your enterprise maintains a central BigQuery dataset named source_sales in project corp-analytics-prod that contains detailed order information and customer personally identifiable information (PII). You need to publish a collection of curated analytical views that exclude sensitive PII to an external analytics partner group (partner-analysts@partner.com). The implementation must satisfy the following requirements: Prevent partner analysts from querying or browsing underlying tables in source_sales directly. Automatically permit all current and future views in the publishing dataset to read data from source_sales without individual view authorization. Follow the principle of least privilege for IAM permissions while allowing partner analysts to execute queries against the published views. Which configuration should you implement?

Publishing datasets

AdvancedProfessional Cloud Data Engineer

A data platform team operates large-scale ELT pipelines and BigQuery analytics workloads across multiple Google Cloud projects. The team needs to establish a proactive cost governance and monitoring strategy to satisfy the following requirements: Analyze and visualize granular, resource-level historical infrastructure spend against planned budgets in Looker Studio. Ensure downstream dashboards and reporting queries remain resilient to schema updates and added fields in the underlying billing export tables. Receive proactive notifications whenever projected monthly spend is trending to exceed defined budget thresholds before the billing cycle completes. Which architecture and configuration should the team implement?

Monitoring planned usage

AdvancedProfessional Cloud Data Engineer

An enterprise is designing a real-time data ingestion pipeline that transfers highly sensitive customer financial records from compute workloads in a private Virtual Private Cloud (VPC) to a managed Cloud SQL database instance. The security compliance policy mandates two strict requirements: All database connections in transit must strictly enforce TLS encryption, completely rejecting unencrypted client traffic. Data access must be restricted to internal network flows, and database resources must be protected against data exfiltration risks to unauthorized services outside the designated environment. Which combination of architecture and security configurations should the data engineer implement to satisfy these requirements?

Data encryption

AdvancedProfessional Cloud Data Engineer

An enterprise e-commerce platform processes high-frequency transactional updates for customer orders and inventory line items while concurrently running complex business intelligence queries across multi-year purchasing histories. The data engineering team must design a storage and schema architecture that satisfies the following requirements: Maintain strict transactional write integrity, external consistency, and eliminate update anomalies for operational workloads. Minimize compute slot consumption and eliminate expensive join operations when running large-scale analytical aggregations over hierarchical order data. Which schema design strategy should the team implement across Google Cloud services?

Deciding the degree of data normalization

FundamentalAssociate Data Practitioner

Uniform Bucket-Level Access

Compare methods of access control for Cloud Storage (e.g., public or private access, uniform access)

Professional Cloud Data Engineer

Analytics Hub Vpc Service Controls Linked Views

Related questions

Uniform Bucket-Level Access

Professional Cloud Data Engineer

Analytics Hub Vpc Service Controls Linked Views

What the VPC Service Controls Configuration Is

How It Meets the Requirements

Key Advantages

Why This Is Optimal

Related questions

Uniform Bucket-Level Access

What the VPC Service Controls Configuration Is

How It Meets the Requirements

Key Advantages

Why This Is Optimal