Cloud Digital Leader Trust and security with Google Cloud Practice Question
A company wants to ensure that their confidential data stored in BigQuery cannot be shared outside the company's Google Cloud organization. Which Google Cloud security capability prevents data from being shared with external Google accounts (outside the organization)?
⚠ Common exam trap
Many exam-takers confuse data-at-rest encryption (CMEK) or data filtering (row-level security) with access control, failing to realize that only an organization policy constraint can prevent the initial IAM grant that shares data with external accounts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The 'Domain Restricted Sharing' organization policy constraint, which prevents IAM policies from granting access to users outside specified trusted domains
The 'Domain Restricted Sharing' organization policy constraint (constraints/iam.allowedPolicyMemberDomains) explicitly prevents IAM policies from granting access to principals outside of specified trusted domains. This directly blocks sharing BigQuery data with external Google accounts by enforcing that all IAM members belong to the allowed domains, such as the company's own Google Workspace domain.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enabling BigQuery data encryption with CMEK to prevent external parties from decrypting shared data
Why it's wrong here
CMEK protects against unauthorized access to storage infrastructure. If an IAM policy grants an external user access to the BigQuery dataset, they can query it regardless of CMEK — the encryption is transparent to authorized users.
- ✓
The 'Domain Restricted Sharing' organization policy constraint, which prevents IAM policies from granting access to users outside specified trusted domains
Why this is correct
Domain Restricted Sharing is the correct control. It's an org policy constraint that makes it impossible to add external users (gmail.com accounts or accounts from other Google Cloud organizations) to any IAM policy in the organization. This prevents accidental or intentional sharing of resources outside the company's domain.
- ✗
BigQuery row-level security policies that restrict rows based on user email domain
Why it's wrong here
BigQuery row-level security applies a filter to restrict which rows a given user can see, but it only functions after that user has been granted dataset access via IAM. It cannot prevent an external user from being added to a dataset IAM policy in the first place, because RLS is a post-access control. Consequently, RLS is ineffective at stopping external parties from being granted access, which is the exact concern in this scenario.
- ✗
Disabling external IP addresses on all Google Cloud resources to prevent data from leaving the organization's network
Why it's wrong here
Disabling external IP addresses only affects network routing and egress from VMs; it does not change how IAM authorizes access to BigQuery. BigQuery is a serverless Google-managed service, and external users authenticate through Google's API endpoints, not through your VM's IP addresses. Therefore, even with all external IPs disabled, an external user with an IAM binding can still query the dataset, so this does not prevent IAM-based sharing.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Google Cloud
Google Cloud is a suite of cloud computing services offered by Google that provides infrastructure, platform, and software solutions over the internet.
Key term
BigQuery
BigQuery is a fully managed, serverless data warehouse on Google Cloud that lets you run fast SQL queries on massive datasets without managing any infrastructure.
About these practice questions
One of 829 original GCDL practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.