Google Professional Data Engineer Question 199
Single answerGoogle Cloud PlatformYou are a data engineer at a retail company that wants to securely share sales data stored in BigQuery with a third-party analytics vendor. The vendor should only have access to query specific tables and not view or modify any other data in your project. Which approach should you take to meet these requirements?
- A
Grant the vendor the BigQuery Admin role at the project level.
- B
Grant the vendor the BigQuery Data Viewer role at the dataset level containing the sales data.
- C
Create a new service account, grant it read access to the specific tables, and share the service account credentials with the vendor.
- D
Use authorized views to expose only the necessary data and grant the vendor access to query the view.
Show answer and explanation
Correct answer: D
Explanation
The best practice for securely sharing specific data in BigQuery is to use authorized views. Authorized views allow you to expose only the necessary data while keeping the underlying tables and other project resources secure. This approach ensures granular control and adheres to the principle of least privilege. Other options either provide excessive access or violate security best practices.
- A. Incorrect.
Granting the BigQuery Admin role at the project level gives the vendor full administrative access to all datasets and tables, which violates the principle of least privilege and is not secure for this use case.
- B. Incorrect.
Granting the BigQuery Data Viewer role at the dataset level would give the vendor access to all tables within the dataset, which might expose more data than required and does not align with the specific table access requirement.
- C. Incorrect.
Sharing service account credentials violates best practices for security and identity management, as it compromises the principle of accountability and makes it difficult to audit access.
- D. Correct.
Using authorized views ensures that the vendor can only access the specific data they are authorized to see. By creating a view with appropriate query logic and granting access to only the view, you maintain security and adhere to the principle of least privilege.