Cloud Digital Leader Practice Question: Google Cloud products, services, and solutions

Exhibit

Refer to the exhibit.
```json
{
  "bindings": [
    {
      "role": "roles/bigquery.dataViewer",
      "members": [
        "user:alice@example.com"
      ]
    },
    {
      "role": "roles/bigquery.dataOwner",
      "members": [
        "user:bob@example.com"
      ]
    },
    {
      "role": "roles/bigquery.jobUser",
      "members": [
        "group:analysts@example.com"
      ]
    }
  ]
}
```

A data team has an IAM policy on a BigQuery dataset as shown. Alice needs to run a query that joins across multiple datasets. She receives a permission error. What is the most likely cause?

⚠ Common exam trap

Many candidates assume dataset-level read permissions (like `dataViewer`) are sufficient to run queries, but BigQuery requires the separate `jobUser` role at the project level to execute query jobs.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Alice lacks the jobUser role to run queries

The BigQuery `jobUser` role is required to run query jobs, including those that join across datasets. The IAM policy shown only grants dataset-level permissions (like `dataViewer` or `dataOwner`), but Alice lacks the `jobUser` role at the project level, which is necessary to submit a query job. Without this role, she receives a permission error even if she has read access to the datasets.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy denies all users except Bob
Why it's wrong here
BigQuery IAM is allow-based; there is no implicit deny that blocks everyone except Bob. An explicit deny for all users would require a deny policy or an IAM condition, not merely assigning Bob a role. The dataset policy grants other roles alongside Bob's, so Alice's access is evaluated independently. Thus this statement misreads how IAM authorization works.
✓
Alice lacks the jobUser role to run queries
Why this is correct
Running a query in BigQuery requires two permission sets: data access, such as roles/bigquery.dataViewer, and job execution permission, such as roles/bigquery.jobUser, to create a query job. Alice has dataViewer on the dataset, but that role lacks the bigquery.jobs.create permission at the project or job level. Without jobUser (or a broader role like roles/bigquery.user), her query requests fail even though she can read table data. This is the specific reason her query fails.
✗
Alice does not have permission to read the dataset
Why it's wrong here
roles/bigquery.dataViewer grants Alice bigquery.tables.get, bigquery.tables.getData, and related read-only permissions on the dataset and its tables. That means she can access, inspect, and read table rows directly via tabledata.list or SQL previews. The failure occurs only when she attempts to execute a query job, not when reading existing table data. Therefore the claim that she lacks read permission is factually incorrect.
✗
Bob’s dataOwner role prevents others from querying
Why it's wrong here
roles/bigquery.dataOwner gives Bob ownership-level control over the dataset, including permission to edit, delete, and manage it, but it does not grant him the ability to revoke or override permissions granted to Alice. IAM permissions are additive; Alice's dataViewer role is unaffected by Bob's higher-privileged role. No built-in BigQuery role can block another principal's query access unless an explicit deny or IAM condition is configured. So Bob's role does not prevent others from querying.

Go deeper

Cloud Digital Leader Practice Question: Google Cloud products, services, and solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question