How to Configure BigQuery Roles for Shared and Private Datasets?

PDE By islever Editorial Last updated

Short answer

C Give analysts the BigQuery Data Viewer role on the shared dataset. Create a dataset for each analyst, and give each analyst the BigQuery Data Editor role at the dataset level for their assigned dataset.

Question

You want to store your team’s shared tables in a single dataset to make data easily accessible to various analysts. You want to make this data readable but unmodifiable by analysts. At the same time, you want to provide the analysts with individual workspaces in the same project, where they can create and store tables for their own use, without the tables being accessible by other analysts. What should you do?
  1. Give analysts the BigQuery Data Viewer role at the project level. Create one other dataset, and give the analysts the BigQuery Data Editor role on that dataset.
  2. Give analysts the BigQuery Data Viewer role at the project level. Create a dataset for each analyst, and give each analyst the BigQuery Data Editor role at the project level.
  3. Give analysts the BigQuery Data Viewer role on the shared dataset. Create a dataset for each analyst, and give each analyst the BigQuery Data Editor role at the dataset level for their assigned dataset. Correct Answer
  4. Give analysts the BigQuery Data Viewer role on the shared dataset. Create one other dataset and give the analysts the BigQuery Data Editor role on that dataset.

Key Takeaways

This question tests the principle of least privilege and dataset-level scoping, where the common trap is applying roles too broadly at the project level or failing to isolate individual workspaces into separate datasets.

To balance data sharing with privacy in BigQuery, apply IAM roles at the dataset level rather than the project level. The community consensus confirms that assigning the Data Viewer role to a shared dataset and the Data Editor role to individual datasets ensures analysts can read shared data while working in isolated private workspaces.

Common mistake: Selecting Option D is a frequent error because it creates a single shared workspace for individual work, failing to isolate analysts' tables from one another as required.

Expert Analysis

Why the Answer Is Correct

Option C correctly applies the BigQuery Data Viewer role specifically to the shared dataset, ensuring read-only access without modification rights. By creating separate datasets for each analyst and assigning the BigQuery Data Editor role at the dataset level, it grants them the ability to create and manage their own tables. This configuration strictly enforces the requirement that other analysts cannot access these individual workspaces.

Why the Other Options Are Wrong

Options A and B incorrectly apply roles at the project level, which grants overly broad permissions, such as viewing all datasets or editing the shared data. Option D fails the requirement for individual workspaces by creating only one additional dataset for all analysts, meaning they would see and potentially modify each other's work.

Community Comment Notes

Community members consistently highlighted that Option C is the only solution that effectively prevents analysts from viewing the individual datasets of their colleagues. Comments specifically praised the use of dataset-level permissions to create private workspaces while maintaining read access to shared resources.

Official Reference

https://cloud.google.com/bigquery/docs/access-control

This link opens the official vendor documentation in a new tab.

Exam Strategy

Pay close attention to the scope of IAM permissions, specifically distinguishing between project-level and dataset-level assignments. When questions require "individual" or "private" workspaces, look for options that provision separate resources per user rather than a single shared resource.

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. raaad 👍 10 Answered C
    - Data Viewer on Shared Dataset: Grants read-only access to the shared dataset. - Data Editor on Individual Datasets: Giving each analyst Data Editor role on their respective dataset creates private workspaces where they can create and store personal tables without exposing them to other analysts.
  2. scaenruy 👍 2 Answered C
    C. Give analysts the BigQuery Data Viewer role on the shared dataset. Create a dataset for each analyst, and give each analyst the BigQuery Data Editor role at the dataset level for their assigned dataset.
  3. Sofiia98 👍 2 Answered C
    option C, because analysts can not see the individual datasets of other analysts
  4. meh_33 👍 1 Answered C
    Will GO with C
  5. JyoGCP 👍 1 Answered C
    Option C
Show 1 more comment
  1. hanoverquay 👍 1 Answered C
    voted C

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to establish consistent BigQuery spend?

S-grade

Triggering Airflow DAGs Reactively in Private Cloud Composer

S-grade

How to resolve Cloud Composer 2 worker pod evictions and task failures?

S-grade

Which Google Cloud database for on-prem PostgreSQL with analytics?

S-grade

← Back to PDE Study Guide