Professional Cloud ArchitectDemo

By Google · Question Mode

QuestionQ74

Designing for security and compliance

Your company collects all web-traffic data in Google Analytics 360 and stores it in BigQuery. Each country has a separate dataset, and every dataset contains multiple tables.

You want analysts in each country to view and query data only for their own country.

How should you configure the access rights?

  • A Create a group per country. Add analysts to their respective country-groups. Create a single group 'all_analysts', and add all country-groups as members. Grant the 'all_analysts' group the IAM role of BigQuery jobUser. Share the appropriate dataset with view access with each respective analyst country-group.
  • B Create a group per country. Add analysts to their respective country-groups. Create a single group 'all_analysts', and add all country-groups as members. Grant the 'all_analysts' group the IAM role of BigQuery jobUser. Share the appropriate tables with view access with each respective analyst country-group.
  • C Create a group per country. Add analysts to their respective country-groups. Create a single group 'all_analysts', and add all country-groups as members. Grant the 'all_analysts' group the IAM role of BigQuery dataViewer. Share the appropriate dataset with view access with each respective analyst country- group.
  • D Create a group per country. Add analysts to their respective country-groups. Create a single group 'all_analysts', and add all country-groups as members. Grant the 'all_analysts' group the IAM role of BigQuery dataViewer. Share the appropriate table with view access with each respective analyst country-group.
Explanation

Running queries requires permission to create BigQuery jobs, and reading the data requires read access. Granting the combined analyst group the BigQuery Job User role allows its members to create query jobs, while granting each country-specific group view access to only its corresponding dataset allows access to all tables in that dataset and prevents access to other countries’ datasets.

Community Discussion

No comments yet. Be the first to start the discussion!