Google Professional Data Engineer Question 63
Select 3Google Cloud PlatformYou are designing the data architecture for a new project in Google Cloud. The project must support multiple teams, each with different levels of data access, while ensuring compliance with organizational data governance policies. How should you design the architecture to meet these requirements?
- A
Create separate datasets for each team and assign IAM roles at the dataset level.
- B
Use table-level access controls to manage permissions for sensitive tables.
- C
Enable column-level security using policy tags in BigQuery to restrict access to sensitive data.
- D
Grant Project Owner roles to all team leads for flexibility in managing permissions.
- E
Use a single dataset for all teams and manage access through a flat IAM policy at the project level.
Show answer and explanation
Correct answers: A, B, C
Explanation
To meet data governance requirements, you must design the architecture to enforce granular access controls at the appropriate levels. Using separate datasets with dataset-level IAM roles, table-level access controls, and column-level security via policy tags allows you to restrict access based on team and data sensitivity. Avoid assigning overly broad roles like Project Owner that could compromise security or fail to meet governance policies.
- A. Correct.
This is correct. Creating separate datasets for each team allows you to enforce granular permissions by assigning IAM roles at the dataset level, ensuring proper data governance and access control.
- B. Correct.
This is correct. Table-level access controls in BigQuery provide fine-grained access management, which is essential for securing sensitive data in shared environments.
- C. Correct.
This is correct. Enabling column-level security using policy tags helps ensure compliance with governance policies by restricting access to specific columns containing sensitive information.
- D. Incorrect.
This is incorrect. Granting the Project Owner role to all team leads would violate the principle of least privilege and may lead to unauthorized access or accidental changes to resources.
- E. Incorrect.
This is incorrect. Using a single dataset for all teams with a flat IAM policy at the project level does not provide the necessary granularity to control access per team or enforce data governance effectively.