PCSE Ensuring Data Protection Practice Question
A company uses BigQuery to store sensitive customer data. They want to restrict access to certain columns (e.g., email and SSN) so that only authorized users see the actual values, while other users see a masked version. Which approach should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use BigQuery column-level security with policy tags and data masking rules.
BigQuery column-level security using policy tags and data masking rules allows you to define fine-grained access controls and masking policies on specific columns. This is the recommended approach for column-level access and masking in BigQuery.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use BigQuery column-level security with policy tags and data masking rules.
Why this is correct
This allows setting access controls and masking policies directly on columns, providing dynamic masking based on the user's role.
- ✗
Create separate views for different user groups, each with different column projections.
Why it's wrong here
While views can restrict columns, they do not provide dynamic masking per user; maintaining multiple views is cumbersome and not scalable.
- ✗
Use Cloud Storage signed URLs to grant time-limited access to the data.
Why it's wrong here
Signed URLs are for Cloud Storage objects, not BigQuery tables, and do not provide column-level masking.
- ✗
Use Cloud DLP to scan BigQuery tables and create de-identification jobs that permanently mask the data in the table.
Why it's wrong here
This would modify the underlying data, which is not desired; users need access to original values while some see masked versions.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.