GCP Professional Data Engineer Practice Question

Your analytics team uses Looker Studio to analyze a BigQuery table that includes two PII columns, customer_email and credit_card. Only the Fraud Analysis group may view these columns; all other users must still query the table but never see PII. A Data Catalog taxonomy named PII_Taxonomy with a policy tag called Sensitive_PII already exists, and more PII columns may be added later. With minimal ongoing maintenance and no changes to existing queries or dashboards, how should you enforce this requirement?

Permanently tokenize the PII columns with Cloud Data Loss Prevention before loading the data so all analysts can query the tokenized table safely.
Attach the Sensitive_PII policy tag to the PII columns and grant the Fraud Analysis group the roles/datacatalog.categoryFineGrainedReader role on that policy tag; no other changes are required.
Create an authorized view that excludes the PII columns and direct all non-privileged analysts to query the view instead of the base table.
Enable row-level security on the table and define a filter that removes PII columns for users outside the Fraud Analysis group.

Report Issue

Answer Description

Attach the Sensitive_PII policy tag to the PII columns and grant the Fraud Analysis group the Data Catalog role roles/datacatalog.categoryFineGrainedReader on that policy tag. This role includes the permission that BigQuery checks (datacatalog.policyTagUser), so authorized users see actual values while everyone else receives NULLs, allowing all existing SQL and dashboards to continue functioning. Authorized views would require separate objects to be created and updated for every schema change, row-level security cannot hide individual columns, and irreversible tokenization would prevent even authorized users from seeing real PII.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.