professional-cloud-data-engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
A financial enterprise uses Google Cloud to store sensitive transactional records in a centralized BigQuery dataset. The organization plans to share specific aggregated metrics and filtered record subsets with external partner organizations through BigQuery Analytics Hub while enforcing strict governance and least-privilege access.
The security architecture must satisfy the following requirements:
Which combination of Identity and Access Management (IAM) and BigQuery governance mechanisms should you implement?
Grant partner subscribers the BigQuery Data Editor role directly on the raw transactional dataset and deploy VPC Service Controls perimeters with open ingress and egress rules.
Assign the BigQuery Data Owner role to external subscribers on the primary dataset and configure Dataplex auto data quality scans to redact PII at query execution time.
Grant the partner subscribers the BigQuery Admin role on the publisher's project and create external tables linked directly to Cloud Storage buckets protected by customer-managed encryption keys (CMEK).
Publish an Analytics Hub listing based on authorized views or dynamic row- and column-level security policies; assign the BigQuery Data Viewer role on the shared listing to partner subscribers while restricting source dataset access to publisher administrators.
Grant partner subscribers the BigQuery Data Editor role directly on the raw transactional dataset and deploy VPC Service Controls perimeters with open ingress and egress rules.
Assign the BigQuery Data Owner role to external subscribers on the primary dataset and configure Dataplex auto data quality scans to redact PII at query execution time.
Grant the partner subscribers the BigQuery Admin role on the publisher's project and create external tables linked directly to Cloud Storage buckets protected by customer-managed encryption keys (CMEK).
Publish an Analytics Hub listing based on authorized views or dynamic row- and column-level security policies; assign the BigQuery Data Viewer role on the shared listing to partner subscribers while restricting source dataset access to publisher administrators.
This architecture leverages BigQuery Analytics Hub combined with native BigQuery security primitives—specifically authorized views, row-level security (RLS), and column-level policy tags with dynamic data masking—to distribute governed data without exposing raw underlying storage.
StudyCerts
StudyCertsrow_access_policies) partition visibility by partner_tenant_id at query runtime.roles/bigquery.dataViewer) role and subscription permissions on the Analytics Hub listing allows them to discover the listing and provision a linked dataset inside their own project without granting IAM access to the provider's upstream datasets.This pattern adheres to Google Cloud security best practices by combining resource-level IAM boundaries with granular database engine security (column masking and row-level filtering). It prevents data replication drift while securing sensitive multi-tenant financial data under strict perimeter controls.