Your organization has a strict compliance requirement that all BigQuery datasets must have a specific label (e.g., 'data_classification=restricted') before any data can be loaded. You want to enforce this across all projects in your organization. What should you do?

Grant the BigQuery Data Owner role only to users who promise to add labels.

Use Cloud Audit Logs to monitor for unlabeled datasets and alert the security team.

Create an organization policy with a constraint that requires the label on all BigQuery datasets.

Create a Cloud Function that checks for labels and deletes unlabeled datasets.

Your security team needs to be able to view the metadata of encryption keys in Cloud KMS, but they should not be able to encrypt or decrypt data with the keys. What is the minimum IAM role you should grant them?

Cloud KMS CryptoKey Encrypter/Decrypter (roles/cloudkms.cryptoKeyEncrypterDecrypter) on the key.

Cloud KMS Admin (roles/cloudkms.admin) on the key ring.

Cloud KMS Viewer (roles/cloudkms.viewer) on the key ring or key.

Cloud KMS Signer/Verifier (roles/cloudkms.signerVerifier) on the key.

What is the difference between CMEK and CSEK in Google Cloud?

CMEK is only available for Cloud Storage, while CSEK is available for all Google Cloud services.

CMEK uses keys generated by Google, while CSEK uses keys generated by the customer.

CMEK is used for encryption in transit, while CSEK is used for encryption at rest.

CMEK uses keys managed by the customer in Cloud KMS, while CSEK uses keys supplied directly by the customer for each request.

Which of the following is an example of a Cloud IAM member?

serviceAccount:data-pipeline@project.iam.gserviceaccount.com

projects/my-project/buckets/my-bucket

Google CloudProfessional Data Engineer

Domain 1Objective 1

1.1 Designing for Security and Compliance PROFESSIONAL-DATA-ENGINEER Practice Questions (Page 2)

Part of the Designing data processing systems domain, which accounts for ~22% of the PROFESSIONAL-DATA-ENGINEER exam. Google Cloud does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 3–5 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

9concepts

~22%of the exam

Questions 6–10

6foundation · easy
Which IAM role would you grant to a data analyst who needs to query BigQuery data but should not be able to modify or delete tables?
Select an answer first
7application · medium
Your organization has a strict compliance requirement that all BigQuery datasets must have a specific label (e.g., 'data_classification=restricted') before any data can be loaded. You want to enforce this across all projects in your organization. What should you do?
Select an answer first
8application · medium
Your security team needs to be able to view the metadata of encryption keys in Cloud KMS, but they should not be able to encrypt or decrypt data with the keys. What is the minimum IAM role you should grant them?
Select an answer first
9foundation · easy
What is the difference between CMEK and CSEK in Google Cloud?
Select an answer first
10foundation · easy
Which of the following is an example of a Cloud IAM member?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-DATA-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-DATA-ENGINEER” is a trademark of its owner, used for identification only.