professional-cloud-data-engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
Your enterprise data warehouse in BigQuery contains sensitive customer records stored in a base dataset named customer_master. A data analytics and visualization team needs to query aggregated summary metrics using a business intelligence (BI) dashboard without being granted direct read access to the underlying raw tables in customer_master.
You need to implement a secure, least-privilege architecture using BigQuery native controls that allows the BI team and their visualization tool to run these queries successfully.
Which combination of steps should you perform?
Create the analytical view in the customer_master dataset. Grant the BI team the roles/bigquery.dataViewer role on customer_master and the roles/bigquery.jobUser role on the project.
Create the analytical view in a separate dataset named customer_analytics. Authorize the view to access customer_master. Grant the BI team the roles/bigquery.dataViewer role on both customer_master and customer_analytics.
Create the analytical view in a separate dataset named customer_analytics. Authorize the view to access the customer_master dataset. Grant the BI team the roles/bigquery.user role on the project and the roles/bigquery.dataViewer role on the customer_analytics dataset.
Create the view in customer_analytics. Apply a row access policy on the base tables using GRANT TO ("group:bi-team@example.com") FILTER USING (TRUE). Grant the BI team roles/bigquery.dataOwner on customer_analytics.
Create the analytical view in the customer_master dataset. Grant the BI team the roles/bigquery.dataViewer role on customer_master and the roles/bigquery.jobUser role on the project.
Create the analytical view in a separate dataset named customer_analytics. Authorize the view to access customer_master. Grant the BI team the roles/bigquery.dataViewer role on both customer_master and customer_analytics.
Create the analytical view in a separate dataset named customer_analytics. Authorize the view to access the customer_master dataset. Grant the BI team the roles/bigquery.user role on the project and the roles/bigquery.dataViewer role on the customer_analytics dataset.
BigQuery Authorized Views allow data administrators to share query results and aggregated subsets of data with specific principals or visualization tools without providing them direct access to the underlying source tables or datasets. Security is maintained through Google Cloud's Identity and Access Management (IAM) and BigQuery's dataset authorization framework.
StudyCerts
StudyCertscustomer_analytics) and granting the view authorization on the source dataset (customer_master) allows BigQuery to read base table data on behalf of the authorized view. The analysts never receive permissions on customer_master.roles/bigquery.user role at the project level gives analysts the necessary bigquery.jobs.create permission to execute interactive queries and run reporting jobs.roles/bigquery.dataViewer on the customer_analytics dataset (or directly on the view) enables analysts and BI connectors to read the view definition and its query output without exposing raw source tables.This approach adheres strictly to the principle of least privilege. The data analysts can execute queries and view authorized output, but cannot view, query, or enumerate raw records in the source dataset.
Create the view in customer_analytics. Apply a row access policy on the base tables using GRANT TO ("group:bi-team@example.com") FILTER USING (TRUE). Grant the BI team roles/bigquery.dataOwner on customer_analytics.