Your company is in a highly regulated industry. One of your requirements is to ensure individual users have access only to the minimum amount of information required to do their jobs. You want to enfo

Question

Options

• ADisable writes to certain tables.
• BRestrict access to tables by role.
• CEnsure that the data is encrypted at all times.
• DRestrict BigQuery API access to approved users.
• ESegregate data across multiple tables or databases.
• FUse Google Stackdriver Audit Logging to determine policy violations.

Explanation

B, D, and E are the three correct approaches for enforcing least-privilege access in BigQuery.

Why the correct answers work: Restricting table access by role (B) directly maps job functions to data permissions - users only see tables their role requires. Restricting BigQuery API access to approved users (D) prevents unauthorized individuals from even initiating queries, enforcing least privilege at the service entry point. Segregating data across multiple tables or datasets (E) enables fine-grained IAM policies - you can't grant minimal access if sensitive and non-sensitive data live in the same table.

Why the distractors fail:

• A (disable writes): Addresses data integrity, not information visibility - read access is what "minimum required information" is about.
• C (encryption): Protects data at rest/in transit but does nothing to control who can decrypt and read it; BigQuery encrypts by default anyway.
• F (Stackdriver Audit Logging): This is a detective control - it tells you after the fact that a violation occurred. The question asks how to enforce the requirement, which requires preventive controls.

Memory tip: Think "PAD" - Permissions by role, API access restriction, Data segregation. These three are all proactive access controls, while the wrong answers are either about write-protection, encryption, or after-the-fact detection.

No community discussion yet for this question.