Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ329

Configuring access

An organization uses BigQuery to process highly sensitive, structured datasets. Following the “need to know” principle, you must design Identity and Access Management (IAM) to satisfy these users:

  • Business user: must access curated reports.
  • Data engineer: must administer the data lifecycle on the platform.
  • Security operator: must review user activity on the data platform.

What should you do?

  • A Configure data access log for BigQuery services, and grant Project Viewer role to security operator.
  • B Set row-based access control based on the “region” column, and filter the record from the United States for data engineers.
  • C Create curated tables in a separate dataset and assign the role roles/bigquery.dataViewer.
  • D Generate a CSV data file based on the business user's needs, and send the data to their email addresses.
Explanation

A separate dataset containing only curated tables limits the business user’s accessible data to the approved reporting set. Granting roles/bigquery.dataViewer on that dataset provides read and query access to its tables and views without granting modification or broader access to sensitive source datasets, which follows least privilege.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!