Your company handles data processing for a number of different clients. Each client prefers to use their own suite of analytics tools, with some allowing direct query access via Google BigQuery. You n

The correct answer is B. Load data into a different dataset for each client. D. Restrict a client's dataset to approved users. F. Use the appropriate identity and access management (IAM) roles for each client's users.. Separating client data into distinct datasets (B) is the correct architectural choice because BigQuery's access control boundary is the dataset - each dataset can have its own independent IAM policy, making it the natural isolation unit. Once separated, you must restrict each dat

Submitted by klara.se· Mar 30, 2026Designing data processing systems

Question

Your company handles data processing for a number of different clients. Each client prefers to use their own suite of analytics tools, with some allowing direct query access via Google BigQuery. You need to secure the data so that clients cannot see each other's data. You want to ensure appropriate access to the data. Which three steps should you take? (Choose three.)

Options

ALoad data into different partitions.
BLoad data into a different dataset for each client.
CPut each client's BigQuery dataset into a different table.
DRestrict a client's dataset to approved users.
EOnly allow a service account to access the datasets.
FUse the appropriate identity and access management (IAM) roles for each client's users.

How the community answered

(52 responses)

A
17% (9)
B
71% (37)
C
8% (4)
E
4% (2)

Explanation

Separating client data into distinct datasets (B) is the correct architectural choice because BigQuery's access control boundary is the dataset - each dataset can have its own independent IAM policy, making it the natural isolation unit. Once separated, you must restrict each dataset to approved users (D) so that a client granted access to Dataset A cannot query Dataset B. Finally, using appropriate IAM roles (F) enforces least-privilege: a client's analysts might get roles/bigquery.dataViewer while admins get roles/bigquery.dataEditor, ensuring nobody has more access than needed.

Why the distractors fail:

A (partitions): Partitions optimize query performance and cost - they carry no separate access controls; all partitions in a table share the same permissions.
C (different table): Tables within the same dataset inherit that dataset's IAM policy, so clients could still see each other's tables; you'd need separate datasets, not just separate tables.
E (service account only): The question explicitly states clients need direct query access via their own analytics tools - locking everything to a single service account blocks that requirement entirely.

Memory tip: Think "Dataset = Door, IAM = Lock, Roles = Key type." Each client gets their own door (dataset), you lock it to approved users (restrict access), and give each user the right key type (IAM role) - B, D, F maps directly to this metaphor.

Topics

#BigQuery#IAM#Data Security#Multi-tenancy

Community Discussion

No community discussion yet for this question.

Full PROFESSIONAL-DATA-ENGINEER Practice