GCP Professional Data Engineer Practice Question

Your organization stores click-stream logs as Parquet files in Cloud Storage and exposes them in BigQuery as external tables. A partner company needs SQL access to these logs for its own BI workflows, but you must be certain the partner cannot read or copy the underlying Cloud Storage objects and you want to avoid duplicating the data. Using Analytics Hub, what is the most appropriate way to publish the data to the partner?

Convert the external tables to BigLake tables, add them to a private data exchange listing, and grant the partner only the analyticshub.subscriber role so it can query the linked dataset.
Publish the existing external tables in a public data exchange and rely on Cloud Storage object-level ACLs to restrict who can download the files.
Export the Parquet files to a separate Cloud Storage bucket and distribute signed URLs to the partner instead of using Analytics Hub.
Schedule a daily job that copies the external tables into managed BigQuery tables in a new dataset and share that dataset with the partner through Analytics Hub.

Report Issue

Answer Description

Converting the existing external tables to BigLake tables lets BigQuery enforce fine-grained, table-level permissions while the data stays in Cloud Storage. When those BigLake tables are included in a private Analytics Hub listing, the partner receives a read-only linked dataset. Because BigLake tables are accessed through the BigQuery service account, the subscriber only needs the analyticshub.subscriber role on the listing and BigQuery job permissions in their own project; they are not granted IAM roles on the Cloud Storage bucket. No data is copied, and the partner can run queries without direct object access.

Publishing the raw external tables (choice 2) would still require granting the partner Storage object permissions. Copying the files into managed BigQuery tables (choice 3) avoids the Storage permission issue but duplicates the data and introduces operational overhead. Providing signed URLs outside Analytics Hub (choice 4) bypasses the platform entirely and exposes the files directly, violating the requirement to restrict bucket access.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.