GCP Professional Data Engineer Practice Question

A Kubernetes workload running in Google Kubernetes Engine transforms data and writes the results into a single BigQuery dataset named analytics.raw. The workload's service account must be able to

create new tables or append rows only inside analytics.raw, and
launch its own load and query jobs. It must not be able to read or modify any other datasets, delete tables, or change project-level settings.

Which IAM assignment best follows the principle of least privilege?

Grant the service account roles/bigquery.dataEditor on the entire analytics project.
Grant the service account roles/bigquery.dataOwner on the analytics.raw dataset and roles/bigquery.admin on the project.
Grant the service account the primitive roles/editor role on the project.
Grant the service account roles/bigquery.jobUser at the project level and roles/bigquery.dataEditor on the analytics.raw dataset.

Report Issue

Answer Description

Running load or query jobs in BigQuery requires the permission bigquery.jobs.create, which is included in the predefined role roles/bigquery.jobUser. That permission can only be granted at the project level. Creating tables or inserting/ updating row data inside a single dataset requires bigquery.tables.create and bigquery.tables.updateData, both of which are included in the predefined role roles/bigquery.dataEditor. Granting roles/bigquery.dataEditor only on the analytics.raw dataset confines these data-manipulation abilities to that dataset. Granting roles/bigquery.jobUser at the project level plus roles/bigquery.dataEditor on analytics.raw therefore supplies exactly the required capabilities-no access to other datasets and no broader project-wide privileges-aligning with the principle of least privilege. Other listed options grant permissions that are either too broad (project-wide data editor, data owner, admin, or primitive Editor) or include unnecessary administrative rights.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.