You have a BigQuery table that contains customer data, including sensitive information such as names and addresses. You need to share the customer data with your data analytics and consumer support…

Question

Options

• ACreate two separate authorized datasets; one for the data analytics team and another for the consumer support team.
• BEnsure that the data analytics team members do not have the Data Catalog Fine-Grained Reader role for the policy tags.
• CReplace the authorized dataset with an authorized view. Use row-level security and apply filter_expression to limit data access.
• DRemove the bigquery.dataViewer role from the data analytics team on the authorized datasets.
• EEnforce access control in the policy tag taxonomy.

• A
  44% (18)
• C
  15% (6)
• D
  7% (3)
• E
  34% (14)

Explanation

A is correct because a single authorized dataset applies the same access scope to both teams, making it impossible to enforce different restrictions per team. Separating them into two authorized datasets lets you apply column-level policy tag restrictions for the analytics team and row-level filtering for the consumer support team independently.

B is correct because policy tags only restrict access when users lack the Data Catalog Fine-Grained Reader role on those tags. If the analytics team has this role, they can see the sensitive columns regardless of the policy tag configuration - which is exactly the symptom described. Removing that role closes the bypass.

C is wrong because switching to an authorized view with row-level security addresses the consumer support team's row filtering requirement, not the analytics team's column restriction problem - it doesn't fix why policy tags are being bypassed.

D is wrong because removing bigquery.dataViewer from the analytics team revokes all their data access, not just the sensitive columns. The goal is to restrict, not block entirely.

E is wrong because policy tags are already in place per the scenario - the failure isn't a missing taxonomy configuration, it's that team members hold a role that grants them permission to read through those tags.

Memory tip: Think of policy tags as a locked door and the Fine-Grained Reader role as a master key. The lock means nothing if the team already has the key - always verify who holds the key, not just whether the lock exists.

No community discussion yet for this question.