GCP Professional Data Engineer Practice Question

Your company operates a multi-tenant analytics platform on Google Cloud. All customer data is stored in separate BigQuery datasets that reside in a single project. A Dataflow pipeline, executed by a dedicated service account, loads transformed data into every customer's dataset nightly. Each customer's analysts must be able to query only their own dataset, never see other customers' data, and must not create or modify tables. The central operations team needs to deploy, update, and monitor all Dataflow jobs but must be prevented from reading any customer data. Which IAM design best applies the principle of least privilege while meeting these requirements?

Grant each customer's analysts the primitive Viewer role on the project; grant the Dataflow worker service account roles/bigquery.user; grant the operations team roles/dataflow.admin and roles/bigquery.dataViewer at the project level.
Grant each customer's Google group roles/bigquery.dataViewer at the project level; grant the Dataflow service account roles/bigquery.dataOwner at the project level; grant the operations team roles/owner on the project.
Create a separate service account for each customer's pipeline and grant it roles/bigquery.admin on the customer's dataset; grant the operations team roles/dataflow.viewer at project level; assign no roles to customer groups and share query results through authorized views.
Grant each customer's Google group roles/bigquery.dataViewer on only its dataset; grant the Dataflow worker service account roles/bigquery.dataEditor on every customer dataset; grant the operations team roles/dataflow.admin (and no BigQuery data roles) at the project level.

Report Issue

Answer Description

Granting every customer's Google Workspace group the BigQuery Data Viewer role (dataset-level) restricts them to read-only access on their own dataset and prevents access to others. Giving the Dataflow worker service account BigQuery Data Editor on each dataset lets the pipeline append and modify tables during nightly loads without broader permissions. Assigning the operations team the Dataflow Admin role at the project level allows full control over pipeline creation, update, and monitoring, while withholding any BigQuery data roles ensures they cannot query customer data. The solution therefore enforces separation between tenants, limits privileges to the minimum required for each actor, and satisfies the stated constraints. The other options either grant project-wide visibility to customers, let operations read data, or require unnecessary service accounts, violating least-privilege guidance.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.