GCP Professional Data Engineer Practice Question

Your organization stores transaction data in BigQuery. The cc_number column holds 16-digit credit-card numbers. Analysts build Looker Studio dashboards that only need the last four digits, while internal auditors must see the complete value. Analysts should automatically receive a masked value such as --****-1234, and auditors should see the unmasked value without changing their SQL or reports. Enforcement must occur at query time with minimal ongoing maintenance. Which approach best meets these requirements?

Create an authorized view that uses REGEXP_REPLACE to redact the first 12 digits and give analysts access to the view while auditors query the base table directly.
Run a recurring Dataflow job that copies the table to a separate masked dataset for analysts and keep auditors pointed to the original dataset.
Attach a data masking policy tag that reveals only the last four digits to the cc_number column, grant analysts roles/bigquery.maskedReader on that tag, and grant auditors roles/bigquery.unmaskedReader (or higher) so they bypass the mask.
Enable column-level access control on cc_number and grant auditors the policy tag user role while denying analysts any policy-tag roles.

Report Issue

Answer Description

Dynamic data masking lets BigQuery rewrite queries at execution time and apply a masking rule defined in a policy tag that is attached to a sensitive column. Granting analysts the roles/bigquery.maskedReader role on that tag causes their queries- including those issued by Looker Studio through the BigQuery API- to return masked results. Auditors who have a role with bigquery.tables.getData (for example, roles/bigquery.dataViewer) and also hold roles/bigquery.unmaskedReader on the same tag bypass the mask and see raw data. Because the masking rule resides in the policy tag, no additional views, pipelines, or SQL changes are required, and enforcement remains centralized with minimal maintenance. The other options rely on manual views, data duplication, or access denial rather than policy-based masking.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.