Manage data
Free Google Cloud Associate Data Practitioner practice — 6 questions on Manage data, with explanations. No sign-up. Full 12-question mixed test →
A financial services company stores customer PII, including Social Security numbers, in a BigQuery table queried daily by 200 analysts. Compliance requires that most analysts see only masked SSN values while a small group of senior compliance analysts can view the full value, and all access must be enforced centrally without duplicating the underlying data. Which approach BEST meets these requirements?
BigQuery column-level security with policy tags and dynamic data masking lets you enforce masking rules centrally on a single physical table based on IAM group membership (Fine-Grained Reader with/without masking), avoiding data duplication and view sprawl.
A healthcare organization requires that all BigQuery data at rest be encrypted using keys the organization generates, rotates on its own schedule, and can disable to immediately render data permanently unreadable, with all key usage auditable through Cloud KMS. Which configuration satisfies this requirement?
CMEK lets the organization supply and manage its own Cloud KMS keys for BigQuery; disabling or destroying the key immediately makes the data unreadable, and all key operations are logged and auditable through Cloud KMS and Cloud Audit Logs.
A company runs BigQuery and Cloud Storage workloads across multiple projects. Security requires that even users with valid IAM credentials cannot copy data out of these services to an unauthorized project, a personal Google account, or the public internet, while still allowing free communication among a defined set of internal projects. Which Google Cloud capability should be configured?
VPC Service Controls creates a security perimeter around specified projects/services, blocking data exfiltration to resources outside the perimeter even when the caller has valid IAM permissions, while allowing bridges between trusted projects inside the perimeter.
A data governance team wants to automatically discover assets across BigQuery datasets, Cloud Storage buckets, and Dataflow-produced tables, apply consistent business metadata tags, track end-to-end lineage, and enforce automated data quality rules from one unified control plane. Which Google Cloud service should they use?
Dataplex provides unified data management across BigQuery, Cloud Storage, and lake-based assets, including automated discovery, metadata tagging/cataloging, lineage tracking, and configurable data quality rules from a single governance layer.
You need to configure a Cloud Storage bucket lifecycle policy so that objects automatically move to Nearline storage after 30 days, move to Coldline storage after 90 days, and are permanently deleted after 365 days, all enforced without manual intervention. Which lifecycle configuration correctly achieves this?
Cloud Storage lifecycle management requires a separate rule per distinct condition/action pair; defining three rules with age thresholds of 30, 90, and 365 days correctly implements the staged Nearline → Coldline → Delete transition exactly as required.
Which statement correctly describes the difference between the predefined BigQuery IAM roles roles/bigquery.dataViewer and roles/bigquery.dataEditor when granted at the dataset level?
roles/bigquery.dataViewer provides read-only access to data and metadata, while roles/bigquery.dataEditor is a superset that additionally allows creating, updating, and deleting tables and views in the dataset, which is the exact distinction tested on the exam.
Ready for the real thing?
The full course has two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed answer explanations.
Start my full course on Udemy →