professional-cloud-data-engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
Your organization manages an enterprise analytics warehouse in BigQuery containing tables with sensitive personally identifiable information (PII), such as government identification numbers and contact details. You need to implement a scalable, fine-grained access control architecture that enforces column-level security.
The solution must satisfy the following requirements:
Which strategy should you implement?
Create individual authorized views for every analyst group that exclude sensitive columns, remove all dataset permissions from the underlying tables, and manage column access solely through authorized view permissions.
Create a hierarchical taxonomy with policy tags, assign policy tags to sensitive columns via schema annotations, enforce access control on the taxonomy, and grant compliance officers the Data Catalog Fine-Grained Reader role on the appropriate policy tags while granting analysts standard BigQuery dataset permissions.
Define policy tags within a flat taxonomy, assign the policy tags to columns using standard GoogleSQL CREATE TABLE DDL statements, and grant compliance officers the BigQuery Data Viewer role while granting analysts the Data Catalog Policy Tag Admin role.
Declare primary and foreign key constraints on the sensitive columns in BigQuery, and configure Cloud Armor authorization policies based on VM tags to restrict query results at the network layer.
Create individual authorized views for every analyst group that exclude sensitive columns, remove all dataset permissions from the underlying tables, and manage column access solely through authorized view permissions.
Create a hierarchical taxonomy with policy tags, assign policy tags to sensitive columns via schema annotations, enforce access control on the taxonomy, and grant compliance officers the Data Catalog Fine-Grained Reader role on the appropriate policy tags while granting analysts standard BigQuery dataset permissions.
BigQuery column-level security provides fine-grained access control to sensitive columns using policy tags within a hierarchical taxonomy. This mechanism verifies user access privileges at query time, preventing unauthorized identities from querying, projecting, or viewing sensitive column values while still allowing them to interact with unrestricted columns in the same table.
StudyCerts
StudyCertsroles/bigquery.dataViewer) to query the table, but because they lack policy tag permissions, BigQuery blocks them from reading or filtering on protected columns. Compliance officers are granted the Data Catalog Fine-Grained Reader (roles/datacatalog.fineGrainedReader) role on the specific policy tags, allowing them to read raw PII values.bq CLI tool (bq update), or the tables.patch API method.This solution provides native, scalable access control without needing to build and maintain separate views or duplicate pipelines for different user roles. By using hierarchical taxonomies and the Data Catalog Fine-Grained Reader role, access governance remains maintainable and auditable as the data footprint grows.
Define policy tags within a flat taxonomy, assign the policy tags to columns using standard GoogleSQL CREATE TABLE DDL statements, and grant compliance officers the BigQuery Data Viewer role while granting analysts the Data Catalog Policy Tag Admin role.
Declare primary and foreign key constraints on the sensitive columns in BigQuery, and configure Cloud Armor authorization policies based on VM tags to restrict query results at the network layer.