Your enterprise stores highly sensitive customer transactional data in a centralized BigQuery dataset (raw_transactions). An external partner organization needs to query aggregated daily transaction metrics without gaining direct access to the underlying sensitive tables containing personally identifiable information (PII). You must design a secure data sharing architecture that satisfies the following requirements: The partner can query the pre-aggregated metrics on demand. The partner is prevented from viewing or querying any raw data records. The partner does not require permissions on the underlying raw_transactions dataset. All query operations and data access events must be captured for governance and compliance audits. Which solution should you implement?

Create a new dataset containing a SQL view that aggregates data from `raw_transactions`. Authorize the view to access `raw_transactions`, grant the partner `roles/bigquery.dataViewer` on the new dataset, and enable BigQuery Data Access audit logs.: What BigQuery Authorized Views Are An authorized view in BigQuery is a logical SQL view that allows specific users or groups to query aggregated or filtered data from a source dataset without granting those users direct access to the underlying source tables. By authorizing the view itself to access the source dataset, BigQuery executes queries against the view using the view's elevated dataset authorization rather than the end-user's permissions. How It Meets the Requirements Pre-aggregated metrics on demand: The SQL view definition performs the required aggregation transformations dynamically when queried. Prevent access to raw records: The partner is only granted access to the separate dataset containing the view. Because the view exposes only aggregated outputs, individual transactional PII remains inaccessible. No permissions on source dataset: Because the view itself is explicitly added to the authorized views list of raw_transactions, users only need the roles/bigquery.dataViewer role on the dataset containing the view. Audit trails and compliance: Enabling BigQuery Data Access audit logs (specifically DATA_READ logs) in Cloud Audit Logs ensures every query run against the authorized view is captured with detailed metadata, timestamps, and caller identities. Key Advantages Least Privilege Access: Eliminates the need to grant table-level or dataset-level read permissions on sensitive source data. Zero Data Duplication: Eliminates ETL pipeline overhead and storage redundancy by executing queries on demand. Centralized Security: Revoking access to the view dataset immediately terminates external partner access. Granular Governance: Works seamlessly with IAM roles like roles/bigquery.dataViewer and Cloud Logging. Why This Is Optimal This pattern separates consumer presentation from protected underlying storage while maintaining complete regulatory auditing and strict data isolation.

Bigquery Authorized View Secure Data Sharing | Professional Cloud Data Engineer

AdvancedProfessional Cloud Data Engineer

Your organization stores customer transaction data in a centralized BigQuery table named sales.transactions. You need to securely share this table with three distinct user groups while enforcing the principle of least privilege: Finance Auditors: Must be able to query all rows and view sensitive payment identifiers (such as credit card numbers) in cleartext. Business Analysts: Must be able to query all rows, but sensitive payment identifiers must be dynamically masked (e.g., using a masking rule or hash) so that existing queries continue to run without exposing cleartext data. Regional Sales Managers: Must be restricted to querying only rows where region = 'EMEA', and payment identifiers must be masked. How should you configure access controls and data policies in Google Cloud to achieve these requirements?

Defining rules to share data

AdvancedProfessional Cloud Data Engineer

Your organization uses a custom on-premises visualization tool to generate business intelligence reports. The tool currently connects to relational databases using standard SQL protocols and does not natively support the BigQuery API. You need to integrate this tool with BigQuery to analyze large datasets. Security policies mandate that the connection must not traverse the public internet, and BigQuery resources must be protected from data exfiltration by restricting access strictly to your hybrid network environment. How should you securely integrate the on-premises tool with BigQuery?

Connecting to tools

AdvancedProfessional Cloud Data Engineer

Your organization is designing an enterprise data analytics platform in Google Cloud that processes highly regulated healthcare data across Cloud Storage and BigQuery. Your security and compliance policies dictate the following requirements: All data at rest in Cloud Storage buckets and BigQuery datasets must achieve logical data separation and cryptographic isolation using keys owned and controlled by your organization. Cryptographic keys must be stored in FIPS 140-2 Level 3 Hardware Security Modules (Cloud HSM). A strict separation of duties must be enforced so that data engineers managing storage and analytics resources cannot administer or alter key management configurations. All tables created inside analytics datasets and objects written to ingestion buckets must automatically be encrypted without requiring engineers to explicitly supply key identifiers during write operations. Which architecture and configuration strategy should you implement?

Data security (encryption and key management)

AdvancedProfessional Cloud Data Engineer

An enterprise is implementing a federated data governance model on Google Cloud to support decentralized domain teams. A strategic business domain requires specialized data infrastructure components that are not currently available on the central self-service data platform's roadmap. The domain team wants to build and operate its own custom platform components without delaying its data product deliverables, while the organization's governance board requires consistent security, metadata standards, and policy enforcement across all domains. Which operating and accountability framework should the organization implement?

Building a federated governance model for distributed data systems

AdvancedProfessional Cloud Data Engineer

You are redesigning a data ingestion pipeline for a high-traffic e-commerce platform. Currently, the order management service sends data to a downstream inventory processing service using synchronous API calls. When the inventory service experiences an outage or a traffic spike, the order management service blocks while waiting for responses. This leads to timeouts and cascading failures across the platform. You need to implement a fault-tolerant pattern to achieve the following: Isolate failures so the order management service remains functional during inventory service outages. Prevent cascading effects across the platform. Ensure no data is lost and the inventory service can resume processing from the point of failure once it recovers. Which architectural approach should you implement?

Designing system for fault tolerance and managing restarts

FundamentalAssociate Data Practitioner

Transfer Appliance

Choose the appropriate data transfer tool (e.g., Storage Transfer Service, Transfer Appliance)

Professional Cloud Data Engineer

Bigquery Authorized View Secure Data Sharing

Related questions

Transfer Appliance

Professional Cloud Data Engineer

Bigquery Authorized View Secure Data Sharing

What BigQuery Authorized Views Are

How It Meets the Requirements

Key Advantages

Why This Is Optimal

Related questions

Transfer Appliance

What BigQuery Authorized Views Are

How It Meets the Requirements

Key Advantages

Why This Is Optimal