GCP Professional Data Engineer Practice Question

Your company publishes a BigQuery dataset through Analytics Hub. It contains the table customer_orders with a column market_segment (STRING). Subscribers belong to two Google Groups: [email protected] should only see rows where market_segment = "EU", whereas [email protected] must see every row. You want to share a single table, avoid duplicating data, and ensure that the correct rows are always filtered, even as new data is appended. What should you do?

Partition customer_orders by market_segment and grant partition-level IAM permissions to each group so that analysts can read only the EU partition.
Attach two row-level access policies to customer_orders: one that grants [email protected] access with FILTER USING (market_segment = "EU") and another that grants [email protected] access with FILTER USING (TRUE). Then publish the dataset.
Create a materialized view that filters market_segment = "EU" for the analysts group and share that view, while granting auditors direct access to the base table.
Copy customer_orders into two separate datasets, restrict each dataset with IAM so the analysts group sees the filtered copy and the auditors group sees the full copy, and publish two listings.

Report Issue

Answer Description

Row-level security in BigQuery lets you attach one or more row access policies to a table. Each policy names the principals it applies to and supplies a FILTER USING expression that is evaluated for every query. When several policies match a user, the returned result is the union of the rows allowed by each policy. Creating one policy that grants [email protected] access with the filter market_segment = "EU", and another policy that grants [email protected] access with the filter TRUE (or 1 = 1), satisfies both requirements. The same metadata is enforced automatically on linked datasets created by Analytics Hub, so no extra objects or data copies are needed. Partition-level permissions are not supported, column-level security does not hide whole rows, and creating separate views or datasets increases maintenance and complexity.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.