An enterprise data engineering team is configuring a centralized Data Studio (Looker Studio) reporting dashboard connected to BigQuery. The dashboard will be shared with both internal business analysts who have report edit permissions and external stakeholders who have view-only access. The solution must satisfy the following governance and operational requirements: Report editors must be prevented from modifying the underlying data source connection parameters or viewing raw connection configurations. Data access must not break if the original author of the report or data source leaves the organization. External viewers must be able to view the aggregated dashboard data without requiring direct BigQuery IAM dataset permissions granted to their individual identities. Stakeholders with view access must be restricted from downloading, printing, or copying the dashboard data. Which configuration should the data engineering team implement?

Create reusable data sources using Service Account credentials to connect to BigQuery, and disable downloading, printing, and copying in the report's advanced sharing settings.: What Service Account Credentials and Reusable Data Sources Provide In Data Studio (Looker Studio), managing enterprise reporting at scale requires separating report layout editing from underlying data connection management, ensuring credential persistence, and restricting data dissemination. Creating a reusable data source that authenticates using a dedicated Google Cloud Service Account satisfies these requirements seamlessly. How It Meets All Requirements Prevent Report Editors from Modifying Connections: When a data source is created independently from the home page as a reusable data source, it exists as a separate asset with its own access control list (ACL). Report editors who are only granted access to edit the report layout cannot modify the data source connection settings or query parameters unless explicitly granted edit rights to that reusable asset. Prevent Disruption When Authors Leave: Authenticating with Service Account Credentials binds the data connection to an organizational, non-human identity in Google Cloud rather than an individual employee's personal account (Owner's Credentials). If the report creator departs the organization, scheduled refreshes and report queries continue uninterrupted. Access Without Direct BigQuery IAM: Service Account credentials allow authorized dashboard viewers to query the data through the service account's IAM role (roles/bigquery.dataViewer and roles/bigquery.jobUser), eliminating the need to grant individual GCP IAM access to external viewers. Data Exfiltration Prevention: Disabling the download, print, and copy options within the sharing dialog's advanced settings enforces viewer restrictions, ensuring external stakeholders cannot export raw underlying tabular records or duplicate the asset. Key Advantages Decouples data governance and schema management from report visual design. Centralizes identity lifecycle management through standard Google Cloud IAM service accounts. Prevents credential invalidation when staff roles change or personnel depart. Provides fine-grained distribution control by preventing viewer copying, printing, or exporting. Why This Is Optimal This architecture establishes strict enterprise governance: reusable data sources lock down connection definitions, service accounts eliminate personal credential fragility, and advanced sharing settings prevent unauthorized data dissemination.

Data Studio Enterprise Reporting Governance Credentials

AdvancedProfessional Cloud Data Engineer

An enterprise analytics team orchestrates daily data pipeline workflows in Cloud Composer to refresh BigQuery datasets and publish operational dashboards. The data engineering team needs to operationalize these reporting pipelines under strict governance requirements: Automatically track end-to-end data lineage from source data to downstream BigQuery reporting tables in Dataplex Universal Catalog. Ensure that lineage metadata is accurately captured for both native BigQuery operators and custom Python transformation tasks. Maintain least-privilege security and operational resilience without risking reporting task failures if lineage metadata submission experiences transient issues. Which solution should the team implement?

Publishing reports and visualizations

AdvancedProfessional Cloud Data Engineer

A data engineer is designing security controls for an enterprise Looker deployment that queries a central data warehouse. The implementation must satisfy the following governance requirements: Model-Level Access: Users must only be allowed to see and query specific LookML models assigned to their department. Row-Level Security: Within a shared sales Explore, users must only view records associated with their assigned sales region. Field-Level Security: Sensitive financial metrics (such as gross profit margin) within the shared Explore must only be visible to authorized finance personnel. Which combination of Looker access controls and LookML configurations should the data engineer implement?

Publishing reports and visualizations

AdvancedProfessional Cloud Data Engineer

An enterprise e-commerce platform is designing a real-time event ingestion architecture on Google Cloud for order processing and inventory updates. The system must satisfy the following architectural and operational requirements: Ordering Guarantees: Ensure strict in-order message delivery per merchant account (merchant_id). Operational Overhead: Eliminate cluster provisioning, broker patching, ZooKeeper/KRaft maintenance, and manual partition capacity planning. Elastic Scalability: Automatically scale ingestion throughput up or down to handle sudden traffic spikes without manual partition rebalancing. Delivery Semantics: Provide built-in retry mechanisms, dead-letter support, and granular message acknowledgment. Which messaging framework should the enterprise implement?

Identifying the services (e.g., Dataflow, Apache Beam, Dataproc, Cloud Data Fusion, BigQuery, Pub/Sub, Apache Spark, Hadoop ecosystem, and Apache Kafka)

AdvancedProfessional Cloud Data Engineer

An organization is establishing a secure cloud data warehouse architecture on Google Cloud. Corporate compliance policies mandate strict data governance, data residency, and cryptographic controls across all projects: No storage or analytics service may be created using Google default encryption; all new resources must enforce Customer-Managed Encryption Keys (CMEK). All CMEKs must originate strictly from a centralized, audited security project. Data residency rules require all encryption keys and storage resources to align in the same regional location. Service identities must operate under the principle of least privilege to perform cryptographic operations. Which combination of Google Cloud controls should the data engineering team implement to satisfy these requirements?

Mapping business requirements

AdvancedProfessional Cloud Data Engineer

Your enterprise data team is architecting a multi-step data processing pipeline on Google Cloud that orchestrates dependencies between long-running BigQuery batch transformation jobs and interactive analytical workloads. The design must satisfy the following technical and operational requirements: Orchestrate complex task dependencies, retries, and data transformations across hybrid services using Python. Prevent worker resource starvation and task timeouts while waiting for long-running BigQuery batch jobs to complete. Ensure end-to-end idempotency so that automated task retries or scheduled pipeline re-executions do not result in duplicate records or inconsistent states. Automatically capture and publish end-to-end data lineage to Dataplex Universal Catalog without requiring custom reporting code. Which orchestration and pipeline architecture should you implement?

Interactive or batch query jobs

AdvancedProfessional Cloud Security Engineer

An enterprise enforces strict Infrastructure-as-Code (IaC) baselines across its entire Google Cloud organization. To minimize the window of exposure caused by out-of-band modifications, the security engineering team must design a continuous drift detection and automated remediation pipeline. The solution must satisfy the following architectural requirements: Capture real-time configuration changes and security posture violations across all organization projects as they occur. Ingest change events into a scalable, decoupled, serverless messaging layer. Trigger automated serverless remediation logic (such as Cloud Functions) to evaluate drift against defined baselines and programmatically revert non-compliant resource attributes. Which architecture should the security team deploy?

Managing policy and drift detection at scale (e.g., cloud security posture management, custom organization policies and custom modules for Security Health Analytics).

Professional Cloud Data Engineer

Data Studio Enterprise Reporting Governance Credentials

Related questions

Professional Cloud Data Engineer

Data Studio Enterprise Reporting Governance Credentials

What Service Account Credentials and Reusable Data Sources Provide

How It Meets All Requirements

Key Advantages

Why This Is Optimal

Related questions

What Service Account Credentials and Reusable Data Sources Provide

How It Meets All Requirements

Key Advantages

Why This Is Optimal