GCP Professional Cloud Architect Practice Question

Your organization stores several hundred BigQuery datasets in a single production project. All datasets whose IDs begin with "public_" contain de-identified data that any member of the analytics Google group may query. Datasets with other IDs must remain restricted. You want to grant the analytics group view access only to the public_* datasets and automatically include any future datasets that match this naming pattern, while following the principle of least privilege. What should you do?

Individually grant the analytics group the roles/bigquery.dataViewer role on every dataset whose ID starts with public_, updating the IAM policy whenever new datasets are created.
Create a project-level IAM binding that grants the analytics group the roles/bigquery.dataViewer role only when resource.name.startsWith("projects/_/datasets/public_") evaluates to true.
Create a separate project, publish authorized views of each public_* dataset there, and grant the analytics group Viewer access to that new project.
Grant the analytics group the roles/bigquery.dataViewer role on the entire project that contains all datasets.

Report Issue

Answer Description

An IAM condition lets you attach an expression to an IAM policy binding so that the permissions are effective only when the condition evaluates to true. For BigQuery, the resource.name attribute can be used in conditions, and wildcards such as startsWith() let you match dataset IDs that follow a naming convention. Granting the predefined roles/bigquery.dataViewer role to the analytics group at the project level together with a condition like resource.name.startsWith("projects/_/datasets/public_") allows read access to any existing or newly created dataset whose ID starts with public_, while denying access to all other datasets.
Other options are less appropriate: granting the role on the entire project is overly permissive; assigning dataset-level roles requires ongoing manual updates each time a dataset is added; using authorized views in another project would achieve data isolation but needs continuous creation of views and additional project administration, making it more complex than a single conditional IAM binding.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.