nerdexam
Google

PROFESSIONAL-DATA-ENGINEER · Question #354

You have a BigQuery dataset named "customers". All tables will be tagged by using a Data Catalog tag template named "gdpr". The template contains one mandatory field, "has_sensitive_data", with a…

The correct answer is C. Create the "gdpr" tag template with public visibility. Assign the bigquery.dataViewer role to the HR group on the tables that contain sensitive data. Option C is correct because creating the tag template with public visibility allows all authenticated users in the organization to search Data Catalog using that template's fields without any additional IAM grants - directly satisfying the all-employees search requirement with…

Submitted by yuki_2020· Mar 30, 2026Building and operationalizing data processing systems

Question

You have a BigQuery dataset named "customers". All tables will be tagged by using a Data Catalog tag template named "gdpr". The template contains one mandatory field, "has_sensitive_data", with a boolean value. All employees must be able to do a simple search and find tables in the dataset that have either true or false in the "has_sensitive_data' field. However, only the Human Resources (HR) group should be able to see the data inside the tables for which "has_sensitive data" is true. You give the all employees group the bigquery.metadataViewer and bigquery.connectionUser roles on the dataset. You want to minimize configuration overhead. What should you do next?

Options

  • ACreate the "gdpr" tag template with private visibility. Assign the bigquery.dataViewer role to the HR group on the tables that contain sensitive data.
  • BCreate the "gdpr" tag template with private visibility. Assign the datacatalog.tagTemplateViewer role on this tag to the all employees group, and assign the
  • CCreate the "gdpr" tag template with public visibility. Assign the bigquery.dataViewer role to the HR group on the tables that contain sensitive data.
  • DCreate the "gdpr" tag template with public visibility. Assign the datacatalog.tagTemplateViewer role on this tag to the all employees group, and assign the

How the community answered

(43 responses)
  • A
    12% (5)
  • B
    2% (1)
  • C
    79% (34)
  • D
    7% (3)

Explanation

Option C is correct because creating the tag template with public visibility allows all authenticated users in the organization to search Data Catalog using that template's fields without any additional IAM grants - directly satisfying the all-employees search requirement with zero extra configuration. Assigning bigquery.dataViewer to the HR group only on the sensitive tables then restricts actual data access to HR, fulfilling the second requirement cleanly.

Option A is wrong because private visibility requires you to explicitly grant datacatalog.tagTemplateViewer to every employee (or the all-employees group) so they can see and search by the tag - that's an extra IAM assignment that public visibility makes unnecessary, increasing overhead.

Options B and D are wrong because they both assign datacatalog.tagTemplateViewer to the all-employees group: with private visibility (B) this is a required but avoidable step; with public visibility (D) it is entirely redundant since public already covers it. Both add unnecessary configuration.

Memory tip: Think of tag template visibility like a Google Doc - "public" means anyone in the org can read it without being explicitly added, while "private" means you must invite each person. When the goal is minimize overhead and everyone needs search access, public visibility is the obvious choice.

Topics

#BigQuery#Data Catalog#IAM#Data Security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PROFESSIONAL-DATA-ENGINEER Practice