You are administering a BigQuery dataset that uses a customer-managed encryption key (CMEK). You need to share the dataset with a partner organization that does not have access to your CMEK. What…

Question

Options

• AProvide the partner organization a copy of your CMEKs to decrypt the data.
• BExport the tables to parquet files to a Cloud Storage bucket and grant the storageinsights.viewer role on the bucket to the partner organization.
• CCopy the tables you need to share to a dataset without CMEKs. Create an Analytics Hub listing for this dataset.
• DCreate an authorized view that contains the CMEK to decrypt the data when accessed.

• A
  2% (1)
• B
  4% (2)
• C
  82% (37)
• D
  11% (5)

Explanation

Copying the tables to a non-CMEK dataset and publishing via Analytics Hub is the correct approach because it creates a shareable copy of the data that the partner can access without needing your encryption keys - Analytics Hub is specifically designed for secure, governed cross-organization data sharing in BigQuery.

Why the distractors fail:

• A is a security violation - sharing CMEK private keys defeats the entire purpose of customer-managed encryption and is never an acceptable practice.
• B exports data to Cloud Storage as Parquet files, but storageinsights.viewer is a metadata/reporting role, not a data access role - the partner still couldn't read the files, and this approach bypasses BigQuery entirely unnecessarily.
• D is technically impossible - authorized views control row/column access but have no mechanism to embed or use a CMEK for decryption; encryption is handled at the storage layer, not the query layer.

Memory tip: Think of CMEK as a locked vault - you never hand out the key (A), you don't ship the contents in a broken truck (B), and you can't hide the key inside a window (D). Instead, you make a clean copy in an unlocked vault and put it in the shared marketplace (Analytics Hub = C).

No community discussion yet for this question.