Discuss Google Associate Data Practitioner Exam Topic 4 Question 2

You are a data analyst working with sensitive customer data in BigQuery. You need to ensure that only authorized personnel within your organization can query this data, while following the principle of least privilege. What should you do?

AEnable access control by using IAM roles.

BEncrypt the data by using customer-managed encryption keys (CMEK).

CUpdate dataset privileges by using the SQL GRANT statement.

DExport the data to Cloud Storage, and use signed URLs to authorize access.

Suggested Answer: D

Using IAM roles to enable access control in BigQuery is the best approach to ensure that only authorized personnel can query the sensitive customer data. IAM allows you to define granular permissions at the project, dataset, or table level, ensuring that users have only the access they need in accordance with the principle of least privilege. For example, you can assign roles like roles/bigquery.dataViewer to allow read-only access or roles/bigquery.dataEditor for more advanced permissions. This approach provides centralized and manageable access control, which is critical for protecting sensitive data.

Get Premium Associate Data Practitioner Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

35 comments · newest first

Maynard 11 months ago

D sounds complicated for just querying data!

Dallas 11 months ago

C is useful, but it doesn't cover all access scenarios.

Lindsey 11 months ago

Wait, can you really manage access just with IAM roles?

Tegan 11 months ago

I think B is more about data security than access control.

Kristine 12 months ago

A is definitely the way to go for access control!

Celeste 12 months ago

Exporting data to Cloud Storage with signed URLs seems like a workaround, but I don't think it directly addresses the access control needed for querying in BigQuery.

Mendy 1 year ago

I'm a bit confused about the SQL GRANT statement. I feel like it might be relevant, but I can't recall if it applies to BigQuery specifically.

Raymon 1 year ago

I remember a practice question where we had to manage access to sensitive data, and IAM roles were definitely emphasized as a key solution.

Linwood 1 year ago

I think enabling access control with IAM roles is the best option here, but I'm not entirely sure if it covers all aspects of the least privilege principle.

Ryan 1 year ago

I'm a little confused on the difference between options A and C. Aren't they both about managing permissions? I'll need to review the details on each one to decide which is the better approach for this scenario.

Lawrence 1 year ago

Okay, I think I've got this. The key here is following the principle of least privilege, so I'm leaning towards option A with IAM roles. That way I can really fine-tune the permissions for each authorized user.

Edison 1 year ago

Hmm, I'm not sure about this one. I'm thinking option B with customer-managed encryption keys might be the way to go, but I'm not totally confident. I'll need to double-check the details on that.

Nickie 1 year ago

This seems pretty straightforward. I'd go with option A and use IAM roles to control access. That way I can grant the least amount of privilege to each user.

Karol 2 years ago

I think I would go with A) as well. It's crucial to follow the principle of least privilege when dealing with sensitive data.

Malinda 2 years ago

That's true, but in this case, restricting access through IAM roles is more important to prevent unauthorized queries.

Magdalene 2 years ago

Signed URLs? What is this, the Dark Ages? IAM roles are the modern solution for this problem. Keep up with the times, my dude.

Alana 2 years ago

↳ replying to Magdalene

C) Update dataset privileges by using the SQL GRANT statement.

Naomi 2 years ago

↳ replying to Magdalene

A) Enable access control by using IAM roles.

Yaeko 2 years ago

↳ replying to Magdalene

B) Encrypt the data by using customer-managed encryption keys (CMEK).

Colette 2 years ago

↳ replying to Magdalene

A) Enable access control by using IAM roles.

Tabetha 2 years ago

But what about option B) Encrypt the data by using customer-managed encryption keys (CMEK)? Wouldn't that add an extra layer of security?

Merlyn 2 years ago

Haha, the SQL GRANT statement? That's so 2010. IAM roles are the way to go these days, my friend.

Verdell 2 years ago

↳ replying to Merlyn

D) Export the data to Cloud Storage, and use signed URLs to authorize access.

Ria 2 years ago

↳ replying to Merlyn

C) Update dataset privileges by using the SQL GRANT statement.

Felicia 2 years ago

↳ replying to Merlyn

B) Encrypt the data by using customer-managed encryption keys (CMEK).

Noel 2 years ago

↳ replying to Merlyn

A) Enable access control by using IAM roles.

Kent 2 years ago

I agree with Malinda. IAM roles provide fine-grained access control.

Diane 2 years ago

I'm torn between A and B. Encryption is also important for protecting customer data, but access control should be the priority here.

Cheryll 2 years ago

↳ replying to Diane

User 2: I agree, access control is crucial for protecting sensitive data.

Tarra 2 years ago

↳ replying to Diane

User 1: I think you should go with A) Enable access control by using IAM roles.

Malinda 2 years ago

I think the best option is A) Enable access control by using IAM roles.

Marcos 2 years ago

Definitely going with option A. Using IAM roles is the best way to control access to sensitive data in BigQuery.

Tom 2 years ago

↳ replying to Marcos

Enabling access control with IAM roles is a secure and efficient way to manage data access.

Felton 2 years ago

↳ replying to Marcos

I agree, it's important to follow the principle of least privilege when dealing with customer data.

Verdell 2 years ago

↳ replying to Marcos

IAM roles are definitely the way to go for controlling access to sensitive data in BigQuery.

Google Associate Data Practitioner Exam - Topic 4 Question 2 Discussion