How to Configure BigQuery Roles for Shared and Private Datasets?
You want to store your team’s shared tables in a single dataset to make data easily accessible to various analysts. You want to make this data readable but unmodifiable by analysts. At the same time, you want to provide the analysts with individual workspaces in the same project, where they can create and store tables for their own use, without the tables being accessible by other analysts. What should you do?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
This question tests the principle of least privilege and dataset-level scoping, where the common trap is applying roles too broadly at the project level or failing to isolate individual workspaces into separate datasets.
To balance data sharing with privacy in BigQuery, apply IAM roles at the dataset level rather than the project level. The community consensus confirms that assigning the Data Viewer role to a shared dataset and the Data Editor role to individual datasets ensures analysts can read shared data while working in isolated private workspaces.
Selecting Option D is a frequent error because it creates a single shared workspace for individual work, failing to isolate analysts' tables from one another as required.
Community Discussion (7 comments)
- Data Viewer on Shared Dataset: Grants read-only access to the shared dataset. - Data Editor on Individual Datasets: Giving each analyst Data Editor role on their respective dataset creates private workspaces where they can create and store personal tables without exposing them to other analysts.
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option C correctly applies the BigQuery Data Viewer role specifically to the shared dataset, ensuring read-only access without modification rights. By creating separate datasets for each analyst and assigning the BigQuery Data Editor role at the dataset level, it grants them the ability to create and manage their own tables. This configuration strictly enforces the requirement that other analysts cannot access these individual workspaces.Why the Other Options Are Wrong
Options A and B incorrectly apply roles at the project level, which grants overly broad permissions, such as viewing all datasets or editing the shared data. Option D fails the requirement for individual workspaces by creating only one additional dataset for all analysts, meaning they would see and potentially modify each other's work.Community Comment Notes
Community members consistently highlighted that Option C is the only solution that effectively prevents analysts from viewing the individual datasets of their colleagues. Comments specifically praised the use of dataset-level permissions to create private workspaces while maintaining read access to shared resources.Official Reference
Exam Strategy
Pay close attention to the scope of IAM permissions, specifically distinguishing between project-level and dataset-level assignments. When questions require "individual" or "private" workspaces, look for options that provision separate resources per user rather than a single shared resource.