nerdexam
Google

PROFESSIONAL-DATA-ENGINEER · Question #147

You are integrating one of your internal IT applications and Google BigQuery, so users can query BigQuery from the application's interface. You do not want individual users to authenticate to…

The correct answer is C. Create a service account and grant dataset access to that account. Use the service account's private key to access the dataset. Service accounts are the recommended mechanism for application-level BigQuery access, allowing the app to authenticate without exposing user credentials or granting users direct dataset access.

Submitted by paula_co· Mar 30, 2026Designing data processing systems

Question

You are integrating one of your internal IT applications and Google BigQuery, so users can query BigQuery from the application's interface. You do not want individual users to authenticate to BigQuery and you do not want to give them access to the dataset. You need to securely access BigQuery from your IT application. What should you do?

Options

  • ACreate groups for your users and give those groups access to the dataset
  • BIntegrate with a single sign-on (SSO) platform, and pass each user's credentials along with the query request
  • CCreate a service account and grant dataset access to that account. Use the service account's private key to access the dataset
  • DCreate a dummy user and grant dataset access to that user. Store the username and password for that user in a file on the files system, and use those

How the community answered

(28 responses)
  • A
    7% (2)
  • C
    89% (25)
  • D
    4% (1)

Why each option

Service accounts are the recommended mechanism for application-level BigQuery access, allowing the app to authenticate without exposing user credentials or granting users direct dataset access.

ACreate groups for your users and give those groups access to the dataset

Granting group access still requires individual users to authenticate to BigQuery directly and gives them visibility into the dataset, violating both stated requirements.

BIntegrate with a single sign-on (SSO) platform, and pass each user's credentials along with the query request

Passing individual user credentials through SSO still results in user-level access to the dataset via delegated tokens, failing to prevent users from having implicit dataset access.

CCreate a service account and grant dataset access to that account. Use the service account's private key to access the datasetCorrect

A service account decouples application authentication from individual user identities; by granting the service account IAM access to the dataset and authenticating with its private key, the application queries BigQuery securely without any end-user credential involvement or direct user dataset permissions.

DCreate a dummy user and grant dataset access to that user. Store the username and password for that user in a file on the files system, and use those

Storing plaintext credentials in a filesystem file is a critical security vulnerability exposing the account to anyone with file system or server access, directly violating Google Cloud security best practices.

Concept tested: Service account authentication for application-to-BigQuery integration

Source: https://cloud.google.com/bigquery/docs/authentication#service-accounts

Topics

#service accounts#BigQuery access control#IAM#authentication

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PROFESSIONAL-DATA-ENGINEER Practice