Google Professional Data Engineer Question 6
Single answerGoogle Cloud PlatformYour company has a Google Cloud project that contains sensitive data stored in BigQuery. The security team has mandated that only members of the 'data-analyst' group should be able to query the data in BigQuery, and all other access should be denied. A new intern has joined the team and has been mistakenly granted the 'roles/bigquery.admin' role. What is the most effective way to ensure compliance with the security policy while still allowing the intern to perform their assigned tasks under supervision?
- A
Use an organization policy to deny the 'roles/bigquery.admin' role to all users in the project.
- B
Remove the 'roles/bigquery.admin' role from the intern and assign them the 'roles/bigquery.reader' role instead.
- C
Use a conditional IAM policy to restrict the intern's access to specific datasets in BigQuery.
- D
Create a custom role with only the necessary permissions for the intern and replace 'roles/bigquery.admin' with this custom role.
Show answer and explanation
Correct answer: D
Explanation
To comply with the security policy, it is crucial to limit access to only what is necessary for the intern to perform their tasks. The 'roles/bigquery.admin' role is overly permissive and goes against the principle of least privilege. By creating a custom role with only the required permissions, you can ensure the intern has access to what they need while maintaining compliance with the security policy and protecting sensitive data.
- A. Incorrect.
Using an organization policy to deny the 'roles/bigquery.admin' role would unnecessarily restrict access for other legitimate users in the project who may need admin privileges.
- B. Incorrect.
Simply removing the 'roles/bigquery.admin' role and assigning 'roles/bigquery.reader' may limit the intern's access too much, preventing them from performing their assigned tasks effectively.
- C. Incorrect.
While using a conditional IAM policy could work, there are no guarantees that the intern will not accidentally gain access to more than necessary since the 'roles/bigquery.admin' role is overly permissive.
- D. Correct.
Creating a custom role with only the specific permissions the intern requires is the most effective and secure way to ensure they have the access they need without violating the security policy.