You are a data analyst working with sensitive customer data in BigQuery. You need to ensure that only authorized personnel within your organization can query this data, while following the principle of least privilege. What should you do?
A.
Enable access control by using IAM roles.
B.
Update dataset privileges by using the SQL GRANT statement.
C.
Export the data to Cloud Storage, and use signed URLs to authorize access.
D.
Encrypt the data by using customer-managed encryption keys (CMEK).
BigQuery uses IAM for access control, adhering to least privilege by granting only necessary permissions.
Option A: IAM roles (e.g., roles/bigquery.dataViewer for read-only) restrict query access to authorized users, aligning with Google’s security best practices.
Option B: BigQuery doesn’t support SQL GRANT for dataset privileges; access is managed via IAM or authorized views.
Option C: Exporting to Cloud Storage with signed URLs bypasses BigQuery’s native controls and adds complexity.
[: Google Cloud Documentation - "BigQuery IAM" (https://cloud.google.com/bigquery/docs/access-control)., , ]
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit