How to implement per-user crypto-deletion in BigQuery?

PDE By islever Editorial Last updated

Short answer

A Implement Authenticated Encryption with Associated Data (AEAD) BigQuery functions while storing your data in BigQuery.

Question

You want to encrypt the customer data stored in BigQuery. You need to implement per-user crypto-deletion on data stored in your tables. You want to adopt native features in Google Cloud to avoid custom solutions. What should you do?
  1. Implement Authenticated Encryption with Associated Data (AEAD) BigQuery functions while storing your data in BigQuery. Correct Answer
  2. Create a customer-managed encryption key (CMEK) in Cloud KMS. Associate the key to the table while creating the table.
  3. Create a customer-managed encryption key (CMEK) in Cloud KMS. Use the key to encrypt data before storing in BigQuery.
  4. Encrypt your data during ingestion by using a cryptographic library supported by your ETL pipeline.

Key Takeaways

The exam tests the distinction between table-level encryption (CMEK) and column-level encryption (AEAD), focusing on how AEAD enables crypto-deletion by mapping keys to individual users rather than the entire table.

To achieve per-user crypto-deletion natively in BigQuery, use AEAD (Authenticated Encryption with Associated Data) functions to encrypt data with user-specific keys. This allows data to be rendered unreadable by simply revoking or deleting the specific user's key.

Common mistake: Choosing Customer-Managed Encryption Keys (CMEK) (Option B) is a frequent error because CMEK encrypts the whole table, making it impossible to delete data for a single user without destroying everyone's data.

Expert Analysis

Why the Answer Is Correct

Option A is correct because BigQuery's native AEAD functions allow for column-level encryption using specific keys. By assigning a unique encryption key to each user, you can satisfy deletion requests (crypto-deletion) by simply destroying or revoking that user's key, rendering their data permanently unreadable without deleting the underlying rows.

Why the Other Options Are Wrong

Option B is incorrect because CMEK operates at the table or storage level; destroying a CMEK key would make the entire table unreadable for all users, not just one. Option C implies application-side encryption before storage, which moves away from native BigQuery processing and requires complex external key management. Option D is incorrect because using a custom cryptographic library in an ETL pipeline violates the requirement to adopt native Google Cloud features.

Community Comment Notes

Community consensus strongly supports Option A, highlighting that AEAD functions allow keys to be managed outside of BigQuery. Commenters note that this separation enables the specific workflow of "crypto-deletion" where access revocation effectively deletes the data. The comments also provide direct links to official documentation confirming AEAD is the intended solution for this scenario.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question asks for "crypto-deletion" or "per-user" encryption, immediately look for AEAD functions. Remember that CMEK is for infrastructure compliance and control, not for granular, user-level data erasure.

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. raaad 👍 9 Answered A
    - AEAD cryptographic functions in BigQuery allow for encryption and decryption of data at the column level. - You can encrypt specific data fields using a unique key per user and manage these keys outside of BigQuery (for example, in your application or using a key management system). - By "deleting" or revoking access to the key for a specific user, you effectively make their data unreadable, achieving crypto-deletion. - This method provides fine-grained encryption control but requires careful key management and integration with your applications.
  2. JyoGCP 👍 3 Answered A
    https://cloud.google.com/bigquery/docs/aead-encryption-concepts https://cloud.google.com/bigquery/docs/reference/standard-sql/aead_encryption_functions
  3. scaenruy 👍 2 Answered A
    A. Implement Authenticated Encryption with Associated Data (AEAD) BigQuery functions while storing your data in BigQuery.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to establish consistent BigQuery spend?

S-grade

Triggering Airflow DAGs Reactively in Private Cloud Composer

S-grade

How to resolve Cloud Composer 2 worker pod evictions and task failures?

S-grade

Which Google Cloud database for on-prem PostgreSQL with analytics?

S-grade

← Back to PDE Study Guide