You manage a BigQuery analytical data warehouse in your organization. You want to keep data for all your customers in a common table while you also restrict query access based on rows and columns…

Question

Options

• ACreate row-level access policies to restrict the result data when you run queries with the filter
• BConfigure column-level encryption by using Authenticated Encryption with Associated Data
• CCreate row-level access policies to restrict the result data when you run queries with the filter
• DConfigure dynamic data masking rules to control access to columns at query runtime.
• ECreate column-level policy tags to control access to columns at query runtime.

• A
  3% (1)
• B
  5% (2)
• C
  76% (29)
• D
  16% (6)

Explanation

BigQuery provides two complementary mechanisms for fine-grained access control within a shared table. Row-level access policies (C) use filter conditions tied to user identity or group membership, ensuring that when a user runs a query, only rows they are authorized to see are returned - non-query DML/DDL operations are not affected by these policies, satisfying the restriction on non-query operations. Column-level policy tags (E) let you attach data classification labels to sensitive columns and enforce IAM-based access at query runtime through BigQuery's Data Catalog policy tag hierarchy - users without the 'Fine-Grained Reader' role on the tag simply cannot select those columns. Together, these two controls implement row and column restrictions purely at query time. Options A and C are textually identical in this question; C is accepted as the row-level answer. Option B (AEAD encryption) is a client-side encryption technique that doesn't integrate with BigQuery's access control layer. Option D (dynamic data masking) masks column values rather than restricting access and is a different product feature.

No community discussion yet for this question.