Your organization needs to grant users access to query datasets in BigQuery but prevent them from accidentally deleting the datasets. You want a solution that follows Google-recommended practices…

Question

Options

• AAdd users to roles/bigquery user role only, instead of roles/bigquery dataOwner.
• BAdd users to roles/bigquery dataEditor role only, instead of roles/bigquery dataOwner.
• CCreate a custom role by removing delete permissions, and add users to that role only.
• DCreate a custom role by removing delete permissions. Add users to the group, and then add the

• A
  16% (3)
• B
  5% (1)
• C
  5% (1)
• D
  74% (14)

Explanation

The proper answer regarding to bigquery roles is the listed in the options, the proper rol that resolve this requirement is: roles/bigquery.dataViewer https://cloud.google.com/bigquery/docs/access-control#custom_roles On the other hand, the question explicitly is asking to use the GCP best practices on IAM: GCP Best Practices explain clearly these rules: Policy management - Set organization-level IAM policies to grant access to all projects in your organization. - Grant roles to a Google group instead of individual users when possible. It is easier to add members to and remove members from a Google group instead of updating an IAM policy to add or remove users. - If you need to grant multiple roles to allow a particular task, create a Google group, grant the roles to that group, and then add users to that group. https://cloud.google.com/iam/docs/using-iam-securely#policy_management

No community discussion yet for this question.