Cloud Digital Leader Trust and security with Google Cloud Practice Question
An organization stores sensitive data in BigQuery. They need to restrict access to specific columns based on user role, while allowing analysis at the dataset level. Which feature should they use?
⚠ Common exam trap
Google Cloud often tests the distinction between row-level and column-level access controls, and the trap here is that candidates confuse row-level security (which filters rows) with column-level security (which restricts columns), or mistakenly think IAM dataset-level roles can achieve fine-grained column restrictions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Column-level access control using authorized views or taxonomy policies
BigQuery column-level access control, implemented through authorized views or taxonomy policies (via Data Catalog), allows restricting access to specific columns while preserving dataset-level analysis permissions. Authorized views use SQL logic to expose only permitted columns, and taxonomy policies apply fine-grained access controls at the column level without requiring separate datasets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
BigQuery row-level security
Why it's wrong here
BigQuery row-level security limits the rows a principal can query using a row-level access policy, but it offers no column-level control. Because the requirement centers on sensitive data in specific columns, row filtering cannot hide or restrict those columns. This option leaves unauthorized users able to read all columns of the rows they can access.
- ✓
Column-level access control using authorized views or taxonomy policies
Why this is correct
BigQuery column-level access control can be implemented via authorized views that expose only designated columns while hiding sensitive ones, or via taxonomy policies in Data Catalog that tag columns and enforce fine-grained ACLs. Authorized views allow you to share a filtered projection without granting access to the underlying table, and taxonomies with policy tags enforce column-level restrictions at query time. These mechanisms directly satisfy the need to protect sensitive data in specific columns.
- ✗
IAM roles at the dataset level with fine-grained permissions
Why it's wrong here
IAM roles in BigQuery scope permission to datasets, tables, or views, not to individual columns. Even with fine-grained IAM roles, a user granted Data Viewer on a dataset can read every column in every table of that dataset. Since the requirement is about protecting particular sensitive columns, dataset-level IAM cannot isolate those columns from the rest of the data.
- ✗
Cloud Data Loss Prevention (DLP) to mask data
Why it's wrong here
Cloud DLP is a data security service for discovery, classification, and transformation such as masking or redaction, but it is not a native BigQuery access control mechanism. While DLP can be used to produce or query de-identified data, it does not automatically restrict a user's ability to read the original column values in BigQuery. Relying on DLP alone leaves the underlying sensitive data accessible unless combined with access policies.
Go deeper
Related to this question
Learn chapter
BigQuery and Data Analytics
Key term
BigQuery
BigQuery is a fully managed, serverless data warehouse on Google Cloud that lets you run fast SQL queries on massive datasets without managing any infrastructure.
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
About these practice questions
One of 829 original GCDL practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.