nerdexam
Google

PROFESSIONAL-DATA-ENGINEER · Question #292

You are designing a data mesh on Google Cloud with multiple distinct data engineering teams building data products. The typical data curation design pattern consists of landing files in Cloud Storage,

The correct answer is D. 1. Create a Dataplex virtual lake for each data product, and create multiple zones for landing, raw, and curated data.. Option D is correct because in a data mesh, each data product team should own a dedicated Dataplex lake (providing domain-level isolation) and separate zones for each data stage - landing, raw, and curated - allowing you to apply granular IAM policies per zone so teams only acces

Submitted by javi_es· Mar 30, 2026Designing data processing systems

Question

You are designing a data mesh on Google Cloud with multiple distinct data engineering teams building data products. The typical data curation design pattern consists of landing files in Cloud Storage, transforming raw data in Cloud Storage and BigQuery datasets, and storing the final curated data product in BigQuery datasets. You need to configure Dataplex to ensure that each team can access only the assets needed to build their data products. You also need to ensure that teams can easily share the curated data product. What should you do?

Options

  • A
    1. Create a single Dataplex virtual lake and create a single zone to contain landing, raw, and curated data.
  • B
    1. Create a single Dataplex virtual lake and create a single zone to contain landing, raw, and curated data.
  • C
    1. Create a Dataplex virtual lake for each data product, and create a single zone to contain landing, raw, and curated data.
  • D
    1. Create a Dataplex virtual lake for each data product, and create multiple zones for landing, raw, and curated data.

How the community answered

(40 responses)
  • A
    5% (2)
  • B
    8% (3)
  • C
    18% (7)
  • D
    70% (28)

Explanation

Option D is correct because in a data mesh, each data product team should own a dedicated Dataplex lake (providing domain-level isolation) and separate zones for each data stage - landing, raw, and curated - allowing you to apply granular IAM policies per zone so teams only access the stages relevant to their work, while the curated zone can be published and discovered by other teams.

Why the distractors fail:

  • A & B (single lake, single zone): A single zone collapses all data stages into one security boundary, making it impossible to grant different permissions for landing vs. raw vs. curated data; teams also can't be isolated from each other's assets.
  • C (one lake per product, single zone): Having one lake per team is correct for domain isolation, but a single zone still prevents you from enforcing stage-level access control - you can't stop a team from reading landing files they shouldn't touch if everything is in one zone.

Memory tip: Think "one lake per domain, one zone per stage." A Dataplex lake = a team's data domain boundary; a zone = a security checkpoint for each pipeline stage. If a single zone held everything, you'd have a security perimeter with no internal walls - the whole point of zones is fine-grained access control between pipeline stages.

Topics

#Dataplex#Data Mesh#Access Control#Data Governance

Community Discussion

No community discussion yet for this question.

Full PROFESSIONAL-DATA-ENGINEER Practice