PROFESSIONAL-CLOUD-SECURITY-ENGINEER · Question #264
Your company's users access data in a BigQuery table. You want to ensure they can only access the data during working hours. What should you do?
The correct answer is A. Assign a BigQuery Data Viewer role along with an IAM condition that limits the access to. IAM Conditions support time-based access control natively, allowing you to attach a condition expression to an IAM binding that restricts when the binding is active - for example, only during weekdays between 9 AM and 5 PM. Assigning the BigQuery Data Viewer role with a…
Question
Options
- AAssign a BigQuery Data Viewer role along with an IAM condition that limits the access to
- BRun a gsutil script that assigns a BigQuery Data Viewer role, and remove it only during the
- CAssign a BigQuery Data Viewer role to a service account that adds and removes the users daily
- DConfigure Cloud Scheduler so that it triggers a Cloud Functions instance that modifies the
How the community answered
(42 responses)- A81% (34)
- B5% (2)
- C2% (1)
- D12% (5)
Explanation
IAM Conditions support time-based access control natively, allowing you to attach a condition expression to an IAM binding that restricts when the binding is active - for example, only during weekdays between 9 AM and 5 PM. Assigning the BigQuery Data Viewer role with a time-based IAM condition is the cleanest, fully managed solution that requires no scripting or scheduling infrastructure. The other options all require external orchestration (scripts, service accounts with scheduled jobs, Cloud Scheduler + Cloud Functions) that introduces operational complexity, latency, and potential failure modes - violating the principle of using the simplest effective control.
Topics
Community Discussion
No community discussion yet for this question.