professional-cloud-data-engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
Your organization manages a BigQuery dataset containing a customer transactions table with sensitive Personally Identifiable Information (PII), including columns for tax_id, email_address, and credit_card_number. You are preparing this data for enterprise-wide visualization and reporting.
You have the following security and access requirements:
Which solution should you implement?
Configure an ongoing Cloud Data Loss Prevention (Cloud DLP) batch job to inspect the table and overwrite sensitive columns with pseudonymized tokens stored in an external Cloud KMS lookup table. Grant Auditors IAM access to the KMS decryption key.
Create a Cloud KMS customer-managed encryption key (CMEK) for each sensitive column. Grant Compliance Auditors the Cloud KMS CryptoKey Decrypter role and grant BI Analysts only BigQuery Job User permissions.
Create a taxonomy with policy tags in Dataplex and associate dynamic data masking rules with the tags. Attach the policy tags to the sensitive columns in BigQuery. Grant Compliance Auditors the Fine-Grained Reader role on the policy tags, and grant BI Analysts the Masked Reader role on the policy tags.
Create authorized views in BigQuery that use SQL hashing functions like SHA256() on sensitive columns. Grant BI Analysts access to the authorized views and grant Compliance Auditors direct access to the underlying base tables.
Configure an ongoing Cloud Data Loss Prevention (Cloud DLP) batch job to inspect the table and overwrite sensitive columns with pseudonymized tokens stored in an external Cloud KMS lookup table. Grant Auditors IAM access to the KMS decryption key.
Create a Cloud KMS customer-managed encryption key (CMEK) for each sensitive column. Grant Compliance Auditors the Cloud KMS CryptoKey Decrypter role and grant BI Analysts only BigQuery Job User permissions.
Create a taxonomy with policy tags in Dataplex and associate dynamic data masking rules with the tags. Attach the policy tags to the sensitive columns in BigQuery. Grant Compliance Auditors the Fine-Grained Reader role on the policy tags, and grant BI Analysts the Masked Reader role on the policy tags.
Dataplex policy tags (managed via the Dataplex taxonomy and Data Catalog catalog services) provide a centralized way to enforce column-level access control and dynamic data masking across BigQuery tables. By defining hierarchical taxonomies and assigning masking rules (such as SHA-256 hashing, default masking values, email masking, or nullification) directly to policy tags, organizations can manage data protection policies independently of the underlying table schemas.
StudyCerts
StudyCertsroles/bigquery.maskedReader (or roles/datacatalog.maskedReader) role allows BI analysts to execute queries against the dataset while BigQuery dynamically transforms sensitive column values into masked representations at query runtime.roles/datacatalog.categoryFineGrainedReader role on the specific policy tags. This permission overrides the masking rules and allows authorized identities to view the raw, cleartext values.roles/bigquery.dataViewer on the table but lacks both the Masked Reader and Fine-Grained Reader roles for the attached policy tags, BigQuery rejects queries referencing those protected columns with an access denied error.This approach directly leverages native Google Cloud governance mechanisms in Dataplex and BigQuery. It satisfies all multi-tiered persona requirements (auditors, analysts, and unauthorized users) with zero compute overhead for ETL duplication, unified IAM management, and native integration with visualization tools like Looker Studio.
Create authorized views in BigQuery that use SQL hashing functions like SHA256() on sensitive columns. Grant BI Analysts access to the authorized views and grant Compliance Auditors direct access to the underlying base tables.