Professional Cloud Security Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
A security engineer is configuring column-level security in BigQuery to restrict access to sensitive personal data across an analytical data warehouse. The engineer has completed the following steps:
StudyCerts
StudyCertsPII_Taxonomy with a policy tag named High_Sensitivity.High_Sensitivity policy tag.During validation, the engineer discovers that members of the data analytics group can still execute queries and read cleartext data from the tagged columns, even though they were never granted access to the policy tag.
What action must the security engineer take to ensure that column-level access control is actively enforced?
Define a row-level access policy on the table using a SESSION_USER() filter to restrict visible column values.
Create an authorized view in a separate dataset that excludes sensitive columns, and revoke dataset-level read permissions on the underlying table.
Grant the BigQuery Data Policy Admin role to the data analytics group and reapply the policy tags using a CREATE TABLE DDL statement.
Enable the Enforce access control setting on the taxonomy and grant the Data Catalog Fine-Grained Reader role on the policy tag to authorized principals.
Define a row-level access policy on the table using a SESSION_USER() filter to restrict visible column values.
Create an authorized view in a separate dataset that excludes sensitive columns, and revoke dataset-level read permissions on the underlying table.
Grant the BigQuery Data Policy Admin role to the data analytics group and reapply the policy tags using a CREATE TABLE DDL statement.
Enable the Enforce access control setting on the taxonomy and grant the Data Catalog Fine-Grained Reader role on the policy tag to authorized principals.
Column-level access control in BigQuery operates through a structured four-step workflow: creating taxonomies and policy tags, associating those policy tags with table column schemas, enabling enforcement on the taxonomy, and assigning appropriate IAM permissions to the policy tags. Policy tags attached to table schemas remain inert metadata until taxonomy enforcement is explicitly turned on.
roles/bigquery.dataViewer) will receive access denied errors at query time for protected columns unless they also hold the Data Catalog Fine-Grained Reader (roles/datacatalog.categoryFineGrainedReaderViewer) role on the specific policy tag.This solution completes the native BigQuery column-level security lifecycle without requiring data replication, architectural redesigns, or the maintenance of custom views.