Your enterprise stores sensitive sales and customer data in BigQuery. The dataset implements row-level security (RLS) to restrict sales data access based on each manager's region (SESSION_USER()), along with column-level security policy tags to mask personally identifiable information (PII). You need to configure access for business intelligence (BI) visualization dashboards in Looker Studio so that multiple regional sales managers can view their respective metrics securely while strictly adhering to the principle of least privilege. Which configuration should you implement?

Configure the visualization data source to use Viewer's (OAuth) credentials, grant each manager the BigQuery Job User role on the query project, and grant the BigQuery Data Viewer role on the specific dataset.: What Viewer's Credentials and Granular IAM Roles Are Viewer's Credentials (OAuth) require individual dashboard viewers to authenticate against Google Cloud BigQuery using their own identity rather than a shared service account. Combining this credential model with predefined IAM roles at specific resource hierarchy levels enforces least-privilege access and activates fine-grained security policies. How it meets the requirements Enforce Row-Level Security: When queries execute using the end user's OAuth credentials, BigQuery dynamically evaluates built-in security functions such as SESSION_USER(). This ensures that regional sales managers see only the rows authorized by the row-level security (RLS) policy. Enforce Column-Level Security: BigQuery evaluates the specific user's Fine-Grained Reader permissions on policy tags, masking or unmasking sensitive PII fields based on each viewer's individual authorization. Principle of Least Privilege: Granting roles/bigquery.jobUser on the project provides only the ability to run query jobs without exposing data, while roles/bigquery.dataViewer is restricted specifically to the target dataset rather than the entire project or organization. Key advantages Dynamic Policy Enforcement: Context-aware policies (RLS and column masking) execute per user identity rather than collapsing to a static service identity. Granular IAM Boundary: Isolates project-level compute permissions (bigquery.jobs.create) from dataset-level storage read permissions (bigquery.tables.getData). Comprehensive Auditing: BigQuery Cloud Audit Logs accurately record individual user identities for every executed query instead of masking access behind a generic service account. Why this is optimal Using Owner's Credentials or a single service account bypasses user-specific row-level security and column-level policy tags because BigQuery sees only the service identity. Delegating the query context via Viewer's (OAuth) credentials with narrow dataset-scoped roles guarantees that security controls and least privilege are enforced natively at query execution time.

Configure Secure Bi Connection Bigquery Rls Iam | Professional Cloud Data Engineer

AdvancedProfessional Cloud Data Engineer

Your organization uses a custom on-premises visualization tool to generate business intelligence reports. The tool currently connects to relational databases using standard SQL protocols and does not natively support the BigQuery API. You need to integrate this tool with BigQuery to analyze large datasets. Security policies mandate that the connection must not traverse the public internet, and BigQuery resources must be protected from data exfiltration by restricting access strictly to your hybrid network environment. How should you securely integrate the on-premises tool with BigQuery?

Connecting to tools

AdvancedProfessional Cloud Data Engineer

Your organization uses a Looker dashboard connected to BigQuery to analyze sales performance. The dashboard displays the current month's data and relies on a query that joins a massive sales_fact table with multiple smaller dimension tables. Users are reporting high dashboard latency, and the repeated execution of these complex joins is driving up analytical costs. You need to optimize the data layout and leverage BigQuery BI Engine to minimize query latency and reduce costs. What should you do?

Connecting to tools

AdvancedProfessional Cloud Data Engineer

A financial services organization is building a decentralized data mesh architecture on Google Cloud. Multiple domain teams need to expose curated analytical data products to downstream business analysts across the enterprise. The enterprise architecture board has defined the following technical and regulatory constraints: Downstream business analysts must query aggregated business metrics and sanitized virtual tables without having direct read permissions to the underlying sensitive base datasets. The security and compliance teams require minimal administrative overhead and must avoid managing individual view authorizations as dozens of new analytical views are published. Data domain infrastructure deployments must prevent configuration drift using infrastructure as code (IaC) templates. Which technical requirement and access pattern should the data engineering team implement to satisfy these business objectives?

Mapping current and future business requirements to the architecture

AdvancedProfessional Cloud Data Engineer

An enterprise is planning a multi-workload migration strategy to Google Cloud and must select the optimal data transfer mechanisms based on data source type, transfer volume, and network availability: Workload 1: A 350 TB historical file archive stored on an on-premises Network Attached Storage (NAS) system. The archive must be moved to Cloud Storage within two weeks, but the facility's available outbound internet bandwidth is constrained to 100 Mbps and cannot be upgraded. Workload 2: A mission-critical on-premises transactional PostgreSQL database that powers an active production system. It must be migrated to Cloud SQL for PostgreSQL with minimal downtime using continuous replication until the final cutover. Workload 3: Ongoing daily reporting feeds from SaaS advertising platforms (Google Ads and Salesforce) that must be automatically ingested on a recurring schedule directly into analytical tables without maintaining custom ETL infrastructure. Which combination of services should the organization select for these workloads?

Planning migration and validation to Google Cloud (e.g., BigQuery Data Transfer Service, Database Migration Service, Transfer Appliance, Google Cloud networking, Datastream)

AdvancedProfessional Cloud Data Engineer

An enterprise data architecture team is configuring BigQuery Analytics Hub to publish core multi-terabyte datasets to multiple internal and external subscriber projects. The leadership team requires a clear financial governance model and audit strategy that meets the following criteria: Storage Costs: The publisher project maintains and pays for the primary storage of the underlying shared datasets. Compute / Query Costs: Each subscriber project is financially accountable for its own analytical compute and query processing costs when querying shared linked datasets. Auditing & Monitoring: Table access metadata must be audited centrally in the publisher project, while subscriber projects retain the ability to monitor their own query latency, bytes scanned, and slot utilization. Which architecture and monitoring configuration aligns with BigQuery Analytics Hub best practices and financial governance models?

BigQuery sharing (Analytics Hub)

FundamentalAssociate Data Practitioner

Cloud Dataflow GPU Acceleration

Choose products required to implement basic transformation pipelines

Professional Cloud Data Engineer

Configure Secure Bi Connection Bigquery Rls Iam

Related questions

Cloud Dataflow GPU Acceleration

Professional Cloud Data Engineer

Configure Secure Bi Connection Bigquery Rls Iam

What Viewer's Credentials and Granular IAM Roles Are

How it meets the requirements

Key advantages

Why this is optimal

Related questions

Cloud Dataflow GPU Acceleration

What Viewer's Credentials and Granular IAM Roles Are

How it meets the requirements

Key advantages

Why this is optimal