BigQuery IAM Design for Need-to-Know Access

PCSE By islever Editorial Last updated

Managing and implementing authorization controls. Managing encryption at rest, in transit, and in use.

Short answer

C Create curated tables in a separate dataset and assign the role roles/bigquery.dataViewer to enforce least-privilege access for business users.

Question

Your organization uses BigQuery to process highly sensitive, structured datasets. Following the “need to know” principle, you need to create the Identity and Access Management (IAM) design to meet the needs of these users:
• Business user: must access curated reports.
• Data engineer: must administrate the data lifecycle in the platform.
• Security operator: must review user activity on the data platform.
What should you do?
  1. Configure data access log for BigQuery services, and grant Project Viewer role to security operator.
  2. Set row-based access control based on the “region” column, and filter the record from the United States for data engineers.
  3. Create curated tables in a separate dataset and assign the role roles/bigquery.dataViewer. Correct Answer
  4. Generate a CSV data file based on the business user's needs, and send the data to their email addresses.

Key Takeaways

The trap is assuming Project Viewer grants log access; it does not. Correctly implementing least privilege for data consumers requires specific dataset-level roles like dataViewer.

Learn how to design IAM policies for BigQuery using curated datasets and the roles/bigquery.dataViewer role to meet need-to-know requirements for business users.

Common mistake: Choosing Option A is common because it mentions logging, but it is incorrect because the Project Viewer role lacks permission to view Cloud Audit Logs, making it ineffective for the Security Operator.

Expert Analysis

The question requires an IAM design that enforces the “need to know” principle for three distinct roles in a BigQuery environment. The core challenge is isolating access rights so that each user type only sees what is necessary for their function.

For the Business User, who needs access to curated reports, the most secure and standard practice is to expose data through specific views or tables within a dedicated dataset. Granting the roles/bigquery.dataViewer role on this specific dataset ensures they can read the data but cannot modify it or access other datasets. This directly satisfies the requirement while maintaining strict boundaries.

For the Security Operator, who must review user activity, simply granting a Project Viewer role (as suggested in Option A) is insufficient. A Project Viewer has read-only access to resources but lacks the permissions to view Cloud Audit Logs. To review activity, the operator would need specific log viewer roles such as roles/logging.viewer or roles/logging.privateLogViewer. Therefore, Option A fails because the proposed role does not grant the necessary visibility.

Option B suggests row-based access control filtered by region for data engineers. This is illogical; data engineers typically require broader access to manage the data lifecycle, not restricted regional views for business logic. Furthermore, filtering out US records arbitrarily does not align with administrative duties.

Option D proposes exporting CSVs via email. This is a severe security anti-pattern, violating data protection standards by moving sensitive structured data out of the controlled cloud environment into unencrypted personal inboxes.

While no single option perfectly covers all three roles (the Data Engineer’s needs are not explicitly addressed in any option), Option C is the only technically sound action among the choices. It correctly implements least-privilege access for the Business User using appropriate IAM roles (dataViewer) and resource isolation (separate dataset). In exam contexts, selecting the option that demonstrates correct technical implementation of at least one critical requirement, while others contain fatal flaws (like incorrect permissions or security violations), is the standard approach.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When evaluating IAM options, always verify if the proposed role actually possesses the required permissions. For example, do not assume 'Viewer' implies 'Log Viewer'. Prioritize answers that use granular, service-specific roles (like bigquery.dataViewer) over broad project-level roles when least privilege is emphasized.

Frequently Asked Questions

Why is Project Viewer insufficient for a Security Operator?

Project Viewer allows reading resources but does not grant permissions to view Cloud Audit Logs. A security operator needs specific logging roles like logging.viewer.

What is the best way to restrict business user access?

Create curated tables or views in a separate dataset and grant the roles/bigquery.dataViewer role. This limits them to only the specific data needed.

More PCSE FAQ →

Community Votes

C
56%
A
44%

56% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 10 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 10

  1. MisterHairy 👍 7 Answered C
    Correction. The most correct answer would be C. Create curated tables in a separate dataset and assign the role roles/bigquery.dataViewer. This option directly addresses the needs of the business user who must access curated reports. By creating curated tables in a separate dataset, you can control access to specific data. Assigning the roles/bigquery.dataViewer role allows the business user to view the data in BigQuery. While option A is also a good practice for a security operator, it doesn’t directly address the specific needs of the users mentioned in the question as effectively as option C does. Therefore, if you can only choose one answer, option C would be the most correct.
  2. MisterHairy 👍 1 Answered A
    A. Configure data access log for BigQuery services, and grant Project Viewer role to security operator. This allows the security operator to review user activity on the data platform. C. Create curated tables in a separate dataset and assign the role roles/bigquery.dataViewer. This allows the business user to access curated reports. The data engineer can administrate the data lifecycle in the platform.
  3. JohnDohertyDoe 👍 1 Answered C
    The answers do not fit all the requirements. But the one that addresses is C. A is not right, as even if Data Access logs are enabled, they cannot be viewed by the Security Operator role with viewer, they would need logging.privateLogViewer.
  4. dija123 👍 1 Answered C
    Both Option A and Option C can be effective for different reasons. Option A offers simplicity and aligns with "need to know" for most users, while Option C provides more granular control over data access but requires additional configuration.
  5. dija123 👍 1 Answered A
    Option A (data access logs and Project Viewer for security) offers a simpler path to achieve "need to know" for business users and data engineers while providing the security operator with visibility into user activity.
Show 5 more comments
  1. Nkay17 👍 1
    Answer C: Data Access audit logs—except for BigQuery Data Access audit logs—are disabled by default because audit logs can be quite large.
  2. irmingard_examtopics 👍 1 Answered C
    All of the answers are missing administration of the data lifecycle, C comes closest by fulfilling all other requirements.
  3. Mr_MIXER007 👍 1 Answered C
    C. Create curated tables in a separate dataset and assign the role roles/bigquery.dataViewer.
  4. dija123 👍 1 Answered A
    Sorry I wanted to vote for A
  5. Bettoxicity 👍 1 Answered A
    A is the correct!

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to Implement TLS Interception for On-Premise Traffic in GCP

S-grade

How to Secure Vertex AI Training Jobs with Regional CMEK?

S-grade

Integrating On-Premises Active Directory with Google Cloud IAM

S-grade

Cloud External Key Manager and Confidential VM Implementation Constraints

S-grade

← Back to PCSE Study Guide