GCP-ADP Data Management Practice Test 3 — 15 Questions

Question 1

Your team manages a BigQuery dataset that contains sensitive customer data. You need to allow analysts to query the data while ensuring they cannot view individual sensitive values, and you also need to know which columns contain sensitive data so that policies can be applied consistently. Which two actions should you take? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a view that selects only the non-sensitive columns, and grant analysts access to the view instead of the base table.. Policy tags combined with the Fine-Grained Reader role enforce column-level access so analysts can query permitted columns but not tagged ones, and an authorized view provides a complementary path that exposes only non-sensitive columns. Together they restrict visibility of individual values while keeping the dataset queryable, and policy tags also make it explicit which columns carry sensitive data so governance can be applied consistently.

Answer

Grant the analysts the BigQuery Data Viewer role on the dataset and rely on audit logs to detect misuse.

Answer

Encrypt the dataset with a customer-managed encryption key and share the key only with the analytics team.

Answer

Enable the BigQuery Data Policy API on the project and let it classify columns automatically without further configuration.

Question 2

A retail analytics team stores daily sales data in BigQuery. The table is partitioned by DATE(transaction_time) and clustered by store_id. Analysts frequently run queries that filter on a specific store_id but do not filter on transaction_time. They report that these queries scan the entire table and are slow. What should you recommend to improve query performance for these store-specific queries?

Accepted Answer

Instruct analysts to always include a filter on transaction_time in their queries.. Clustering in BigQuery is effective only when the query filters on the partitioning column first. Because the table is partitioned by DATE(transaction_time), queries that filter only on store_id cannot prune partitions, so they scan the entire table. Adding a filter on transaction_time enables partition pruning, after which BigQuery can use clustering on store_id to further reduce scanned data.

Answer

Change the table to be partitioned by store_id instead of transaction_time.

Answer

Add a materialized view that pre-aggregates sales by store_id and refresh it daily.

Answer

Create a new table that is clustered by store_id and partitioned by DATE(transaction_time), and migrate the data.

Question 3

A financial services company uses Cloud Storage to store sensitive customer transaction logs. Compliance requires that all data be encrypted at rest with customer-managed encryption keys (CMEK) and that key rotation be automated every 90 days. The company already uses Cloud KMS. They want to ensure that new objects uploaded to a specific bucket are automatically encrypted with a CMEK. What should they do?

Accepted Answer

Set a default KMS key on the bucket using the gcloud storage buckets update command with the --default-encryption-key flag.. To automatically encrypt all new objects in a Cloud Storage bucket with a CMEK, you set a default KMS key on the bucket. This ensures that any object uploaded without an explicit encryption key uses the specified CMEK. The Cloud Storage service account must have permission to use the key, and Cloud KMS handles key rotation automatically.

Answer

Enable uniform bucket-level access and set the bucket's retention policy to 90 days.

Answer

Use the gcloud storage cp command with the --encryption-key flag for every upload.

Answer

Create a Cloud KMS key ring and key, then grant the Cloud Storage service account the cloudkms.cryptoKeyEncrypterDecrypter role on the key.

Question 4

You have sensitive data in Cloud Storage that needs to be deleted after 30 days to comply with regulatory requirements. What is the most efficient way to manage this?

Accepted Answer

Use Cloud Storage lifecycle management policies. Cloud Storage Object Lifecycle Management lets you define rules directly on a bucket (e.g., Delete objects 30 days after creation) that GCS enforces automatically at no additional cost. This is the native, server-side, most efficient mechanism for time-based deletion and requires no code, scheduler, or external service.

Answer

Run a manual BigQuery script

Answer

Write a Cloud Function to check dates and delete files

Answer

Create a Dataplex lifecycle task

Question 5

You need to ensure that PII (Personally Identifiable Information) in BigQuery is automatically detected and tagged across your organization. Which Dataplex feature should you enable on your Lake?

Accepted Answer

Automatic data discovery. Automatic data discovery in Dataplex scans data in a Lake and automatically identifies and tags sensitive information such as PII using built-in or custom data classifiers. It profiles data assets and applies metadata tags, which is exactly what's needed to detect and tag PII across an organization.

Answer

Data quality task

Answer

Lifecycle management policy

Answer

IAM policy inheritance

Question 6

Which service should you use to search for and discover datasets across your entire Google Cloud organization?

Accepted Answer

Data Catalog. Data Catalog is Google Cloud's fully managed, scalable metadata management service that enables search and discovery of datasets across the organization. It provides a unified inventory of data assets with tagging and search capabilities, making it the correct choice for discovering datasets organization-wide.

Answer

BigQuery Explorer

Answer

Cloud Storage Browser

Answer

Cloud Logging

Question 7

You need to control access to specific columns in a BigQuery table using Dataplex-integrated policy tags. What must you create before you can apply a policy tag to a column?

Accepted Answer

Policy Tag Taxonomy. Policy tags in BigQuery are organized within a Policy Tag Taxonomy, which is a hierarchical container created in Data Catalog (now Dataplex Universal Catalog). Before any policy tag can be applied to a column, you must first create a taxonomy to hold the tags, then create the individual policy tags inside it, and finally grant the Fine-Grained Reader role to users. The taxonomy is the mandatory parent resource — you cannot create a standalone policy tag without it.

Answer

Data Zone

Answer

IAM Condition

Answer

BigQuery Dataset permission

Question 8

What is the purpose of a 'Data Zone' in Dataplex?

Accepted Answer

To provide a logical grouping for governance and policies. A Data Zone in Dataplex is a logical construct that groups data assets (such as Cloud Storage buckets, BigQuery datasets, and BigLake tables) so that a single set of governance policies, discovery, and access controls can be applied across them. It does not provision or represent physical storage; it is an organizational boundary that maps to underlying resources. This lets data stewards manage metadata, quality, and security consistently without moving or duplicating data.

Answer

To execute Spark jobs

Answer

To store query results

Answer

To act as a physical storage location

Question 9

What happens if you delete a Dataplex Lake?

Accepted Answer

The lake is deleted, but the underlying assets remain. Deleting a Dataplex Lake removes the lake resource itself but does not delete the underlying data assets (such as Cloud Storage buckets or BigQuery datasets) that were attached to it. The assets remain intact and can be re-attached to another lake or managed separately. This design prevents accidental data loss and allows for flexible re-organization of data governance structures.

Answer

The data is moved to a 'trash' bucket

Answer

Access to the assets is granted to all users

Answer

All underlying data assets are deleted

Question 10

You are configuring a Dataplex Data Quality task. You want to validate that a 'user_id' column has no NULL values. Where do you define this rule?

Accepted Answer

In a YAML configuration file. Dataplex Data Quality tasks are defined using a YAML specification that describes the rules, including non-null constraints on columns. The YAML file is uploaded to a Cloud Storage bucket and referenced when creating the Data Quality task. This approach allows for flexible, version-controlled rule definitions that are decoupled from the underlying data schema.

Answer

In the Cloud Storage metadata

Answer

In the BigQuery table schema

Answer

In the Dataplex Asset definition

Question 11

You need to audit who accessed sensitive data in a Dataplex Lake. Which service should you monitor to see access logs for these data assets?

Accepted Answer

Cloud Audit Logs. Cloud Audit Logs, specifically Data Access audit logs, record all access to Dataplex Lake data assets, including who accessed what and when. Dataplex integrates with Cloud Audit Logs to provide a unified audit trail for data access across its assets. This is the correct service to monitor for auditing sensitive data access.

Answer

Dataplex Task Logs

Answer

BigQuery Query Logs

Answer

Data Catalog history

Question 12

Which role is required to manage Dataplex assets within a Zone?

Accepted Answer

roles/dataplex.admin. Managing Dataplex assets within a Zone requires the roles/dataplex.admin role, which grants full control over lakes, zones, assets, and their metadata. This role includes permissions to create, update, and delete assets and to manage IAM policies on Dataplex resources.

Answer

roles/storage.admin

Answer

roles/bigquery.admin

Answer

roles/viewer

Question 13

You have a Data Catalog taxonomy that you want to share across multiple projects. How do you achieve this?

Accepted Answer

Define it in a central project and share access. Data Catalog taxonomies are project-scoped resources, so to share one across multiple projects you define it once in a central (host) project and grant other projects' users or service accounts the appropriate Data Catalog IAM roles (e.g., Data Catalog Viewer/Editor) on that taxonomy. This avoids duplication and keeps policy definitions consistent. Cross-project sharing is achieved through IAM bindings, not by relocating the resource.

Answer

Move the taxonomy to the Organization node

Answer

Duplicate the taxonomy in each project

Answer

Use Cloud Resource Manager to link them

Question 14

What is the primary function of the 'Dataplex Discovery' process?

Accepted Answer

To automatically catalog and profile data. Dataplex Discovery is the automated process that scans data assets (Cloud Storage buckets, BigQuery datasets) to infer schemas, extract metadata, and profile data (e.g., statistics, data quality). It populates the Dataplex Catalog so users can search, understand, and govern data without manual cataloging. Its primary function is therefore to automatically catalog and profile data.

Answer

To manage VPC firewall rules

Answer

To run SQL queries

Answer

To migrate data to the cloud

Question 15

You need to track lineage for a BigQuery table populated by a Dataflow pipeline. How does Dataplex help?

Accepted Answer

Dataplex captures it automatically for supported services. Dataplex automatically captures lineage for supported services, including BigQuery and Dataflow. When a Dataflow pipeline writes to a BigQuery table, Dataplex records the lineage information, showing the source and target. This automatic capture eliminates manual effort.

Answer

Lineage is not supported in Dataplex

Answer

You must use a third-party tool

Answer

You must manually enter the lineage in the Data Catalog UI