Google Professional Data Engineer Question 4
Single answerGoogle Cloud PlatformYour organization has recently adopted Google Cloud, and you are responsible for setting up access controls for a team of data analysts. The analysts need read-only access to BigQuery datasets in a specific project, but they should not have the ability to modify or delete the datasets. Additionally, an organization policy enforces strict adherence to the principle of least privilege. What is the best way to configure access for the data analysts?
- A
Assign the 'BigQuery Admin' role at the project level to the data analysts.
- B
Assign the 'BigQuery Data Viewer' role at the project level to the data analysts.
- C
Assign the 'Viewer' role at the project level to the data analysts.
- D
Assign the 'BigQuery Data Viewer' role at the dataset level to the data analysts.
Show answer and explanation
Correct answer: D
Explanation
To comply with the principle of least privilege, access should be granted at the most granular level necessary to fulfill the requirements. Assigning the 'BigQuery Data Viewer' role at the dataset level allows the data analysts to have read-only access to the required datasets without exposing other resources or granting unnecessary permissions.
- A. Incorrect.
The 'BigQuery Admin' role grants full administrative access to BigQuery resources, including the ability to modify or delete datasets. This violates the principle of least privilege.
- B. Incorrect.
The 'BigQuery Data Viewer' role at the project level allows read-only access to all datasets in the project. While it provides the needed read-only access, it exceeds the principle of least privilege by granting access to potentially unnecessary datasets.
- C. Incorrect.
The 'Viewer' role at the project level grants read-only access to all resources in the project, not just BigQuery datasets. This violates the principle of least privilege.
- D. Correct.
The 'BigQuery Data Viewer' role at the dataset level grants read-only access to specific datasets, adhering to the principle of least privilege and meeting the access requirements for the data analysts.