An enterprise is centralizing sensitive customer transaction data from multiple business units into a shared BigQuery data warehouse. The data engineering and security teams must implement a robust security architecture that satisfies the following requirements: Data Exfiltration Mitigation: Prevent unauthorized movement, copying, or API-based access to the BigQuery datasets from outside the organization or across unapproved projects. Tenant & Regional Isolation: Ensure analysts can only query table rows that match their specific geographic region without creating and managing separate physical tables or authorized views for every team. Field-Level Confidentiality: Automatically mask sensitive columns (such as credit card numbers and credit limits) for standard analysts, while allowing authorized compliance officers with explicit fine-grained permissions to view the cleartext data. Which combination of Google Cloud security mechanisms should the team implement?

Enclose the BigQuery storage and compute projects within VPC Service Controls perimeters, define BigQuery Row-Level Security policies filtered by region, and implement policy tags with dynamic data masking and the Fine-Grained Reader role.: What the solution is This architecture combines VPC Service Controls, BigQuery Row-Level Security (RLS), and BigQuery Column-Level Security using Policy Tags and Dynamic Data Masking to establish end-to-end context-aware security and fine-grained data access. How it meets each requirement Data Exfiltration Mitigation: VPC Service Controls establishes a logical security perimeter around Google-managed BigQuery service APIs, blocking data egress, unauthorized copying, and API access originating from outside the perimeter or from unapproved projects/credentials. Tenant & Regional Isolation: BigQuery Row-Level Security applies SQL filter predicates (e.g., WHERE region = 'APAC') directly to the base table based on user group membership (GRANT TO), avoiding the operational maintenance and scaling limits of creating separate tables or hundreds of authorized views. Field-Level Confidentiality: Categorizing sensitive fields with Data Catalog policy tags and attaching Dynamic Data Masking rules automatically redacts or obfuscates column values for general analysts during query runtime, while users granted the Fine-Grained Reader (roles/datacatalog.categoryFineGrainedReader) role can view unmasked cleartext values. Key advantages and capabilities Multi-layered defense: Secures both the network/API transport layer (via perimeter isolation) and the data presentation layer (via column and row policies). Centralized governance: Eliminates data duplication and schema divergence by maintaining a single unified fact table. Native runtime evaluation: Masking and row filtering execute dynamically at query time without altering the underlying raw data storage. Why this is optimal This approach aligns with Google Cloud security best practices by enforcing the principle of least privilege, zero-trust network boundaries, and scalable fine-grained access controls without administrative overhead.