You want to share a BigQuery dataset with a partner who uses a different Google Cloud project. What is the most secure way to grant them access?
Granting the partner's service account BigQuery Data Viewer at dataset level satisfies the cross-project least-privilege constraint. IAM policies accept identities from any Google Cloud project, so no project-level or organisation-wide binding is needed. Dataset-scoped access limits exposure to that single dataset, unlike broader roles that would grant visibility across the project.
Why this answer
Granting the partner's service account the BigQuery Data Viewer role on the dataset is the most secure approach because it follows the principle of least privilege: the partner can read data in that specific dataset only, using their own identity, with no credential sharing. IAM roles can be granted at the dataset level, scoping access precisely and allowing easy revocation.
Exam trap
GCP-ADP often tests least-privilege IAM versus insecure shortcuts like public datasets or shared service account keys, so candidates who prioritize convenience over security pick the wrong answer.
How to eliminate wrong answers
Option B is wrong because making the dataset public grants read access to everyone on the internet, which is the opposite of secure and violates least privilege. Option C is wrong because sharing your project's service account key gives the partner full access to everything that service account can do, and long-lived keys are a major security risk that Google recommends avoiding. Option D is wrong because exporting data to a public Cloud Storage bucket exposes the data to anyone with the URL and creates data duplication and staleness problems.