Google Professional Data Engineer Question 171
Select 3Google Cloud PlatformYour company uses Google Cloud BigQuery to store a large dataset that is shared across multiple distributed teams. Each team should only have access to a specific subset of the data based on their project requirements. As a Data Engineer, how can you ensure that the data is segmented appropriately while maintaining security and minimizing administrative overhead?
- A
Use BigQuery table-level access controls to grant each team access to the entire table and rely on application-side filtering for segmentation.
- B
Create authorized views in BigQuery for each team, exposing only the specific subset of data they need.
- C
Use BigQuery row-level security policies to define access restrictions based on team-specific attributes.
- D
Export the data into Cloud Storage buckets for each team and use bucket-level permissions to control access.
- E
Use BigQuery column-level security to restrict access to sensitive columns and combine it with row-level security for team-based segmentation.
Show answer and explanation
Correct answers: B, C, E
Explanation
To segment data for distributed team usage in BigQuery, you should use features like authorized views, row-level security, and column-level security. Authorized views allow you to filter and expose only the required data subsets for each team without duplicating the data. Row-level security provides fine-grained control over which rows each team can access, based on attributes like project or team ID. Column-level security can further restrict access to sensitive columns, ensuring that teams only see the data relevant to their work. These approaches maintain security and minimize administrative overhead compared to less efficient and less secure alternatives like relying on application-side filtering or exporting data to external systems.
- A. Incorrect.
Using table-level access controls and relying on application-side filtering is not secure, as it exposes the entire table to all teams and increases the risk of unauthorized access to data.
- B. Correct.
Authorized views are an effective and secure way to expose only the required subset of data to each team. These views act as a logical layer that filters the data without duplicating it.
- C. Correct.
Row-level security in BigQuery allows you to define fine-grained access controls based on team-specific attributes, ensuring that each team sees only the rows they are authorized to access.
- D. Incorrect.
Exporting data to Cloud Storage buckets and using bucket-level permissions is not efficient for segmenting BigQuery data. It introduces unnecessary complexity and could result in data duplication.
- E. Correct.
Combining column-level and row-level security in BigQuery provides a robust solution for restricting access to both specific columns and rows, ensuring comprehensive segmentation for distributed teams.