Professional Cloud DevOps Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
A DevOps team is centralizing application and access audit logs into BigQuery to satisfy strict data protection regulations (such as GDPR and HIPAA). The log management design must satisfy the following access and compliance requirements:
Which strategy should the DevOps team implement in BigQuery to meet these requirements?
Assign the bigquery.filteredDataViewer IAM role directly to DevOps engineers on the BigQuery project, and configure authorized views that use WHERE clauses to redact PII and partition data by region.
Deploy a Sensitive Data Protection (DLP) de-identification pipeline to permanently overwrite all PII attributes with SHA256 hashes during log ingestion before loading into BigQuery, and use IAM dataset viewer permissions for access control.
Configure an Assured Workloads data boundary to restrict physical storage to US and EU regions, and create duplicate BigQuery datasets per region with encrypted column backups.
Configure BigQuery Data Policies with a DATA_MASKING_POLICY on sensitive columns to mask fields for general engineers while granting RAW_DATA_ACCESS_POLICY to compliance officers, and define Row Access Policies on the log table to filter visible rows by geographic region.
Assign the bigquery.filteredDataViewer IAM role directly to DevOps engineers on the BigQuery project, and configure authorized views that use WHERE clauses to redact PII and partition data by region.
Deploy a Sensitive Data Protection (DLP) de-identification pipeline to permanently overwrite all PII attributes with SHA256 hashes during log ingestion before loading into BigQuery, and use IAM dataset viewer permissions for access control.
Configure an Assured Workloads data boundary to restrict physical storage to US and EU regions, and create duplicate BigQuery datasets per region with encrypted column backups.
Configure BigQuery Data Policies with a DATA_MASKING_POLICY on sensitive columns to mask fields for general engineers while granting RAW_DATA_ACCESS_POLICY to compliance officers, and define Row Access Policies on the log table to filter visible rows by geographic region.
BigQuery Data Policies and Row Access Policies are fine-grained security controls built directly into BigQuery. Column-level data masking policies control how sensitive column data is displayed to different principals (such as masking via hash or null values), while row access policies act as an inline security filter determining which rows are returned to a user.
StudyCerts
StudyCertsDATA_MASKING_POLICY with masking expressions like SHA256 or ALWAYS_NULL ensures DevOps engineers only see obfuscated sensitive log data.RAW_DATA_ACCESS_POLICY on the same column policy allows them to inspect unmasked raw logs without duplicating tables.CREATE ROW ACCESS POLICY with a FILTER USING (region = ...) statement ensures principals can only view rows corresponding to their assigned geographic boundary.Native BigQuery data policies and row-level access control enforce data masking and residency filtering simultaneously on a single centralized dataset, avoiding the cost, complexity, and synchronization drift of managing multiple filtered tables or custom export pipelines.