1.1 Designing for Security and Compliance PROFESSIONAL-DATA-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   Your company has customers in both the EU and the US. You need to design a data platform that complies with GDPR for EU customer data and allows US customer data to be stored in the US. What is the most appropriate architecture?

   • AUse a single multi-region dataset that spans both the EU and the US.
   • BStore all data in a single US region and rely on encryption to protect EU customer data.
   • CUse separate BigQuery datasets in EU and US regions, and route EU customer data to the EU dataset and US customer data to the US dataset.
   • DStore all data in a single EU region and use VPC Service Controls to restrict access from the US.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   Your data warehouse contains a table with a column that stores customer phone numbers. You need to allow data analysts to query the table, but they should only see the last four digits of the phone number. What is the most appropriate technique?

   • AUse BigQuery's column-level security to restrict access to the phone number column.
   • BEncrypt the phone number column with a CMEK and provide the key to the analysts.
   • CCreate a separate table with only the last four digits and grant analysts access to that table.
   • DCreate a view that uses the SUBSTR function to mask the phone number and grant analysts access to the view instead of the base table.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   Your data science team needs to run BigQuery jobs that read data from a dataset, but they should not be able to modify the data or view the underlying table schemas. What is the minimum IAM role you should grant them?

   • ABigQuery Data Editor at the dataset level.
   • BBigQuery User at the project level.
   • CBigQuery Data Owner at the project level.
   • DBigQuery Job User at the project level and BigQuery Data Viewer at the dataset level.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   Your company has a production BigQuery environment and a development environment. You want to ensure that developers cannot accidentally access or modify production data. What is the most effective way to isolate the environments?

   • AUse the same project but separate datasets for development and production.
   • BUse VPC Service Controls to restrict access to production data.
   • CUse separate projects for development and production, and grant developers IAM roles only on the development project.
   • DUse the same project but grant developers the BigQuery Data Editor role on the development dataset only.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   Your organization is required to use customer-managed encryption keys for all data stored in Cloud Storage. You have created a Cloud KMS key ring and key. You need to configure a new Cloud Storage bucket to use this key. What should you do?

   • AUpload the key material to the bucket and set the encryption type to CMEK.
   • BCreate a new bucket with default encryption and then manually encrypt each object.
   • CSpecify the Cloud KMS key resource name when creating the bucket.
   • DUse the gsutil command to set the encryption key on the bucket after creation.
   Reveal Solution Discussion Select an answer first