Professional-Data-Engineer VCE Exam Download

Comprehensive and Detailed Explanation:

The requirements are role-based access, masking specific columns (PII) for one role, and avoiding data duplication.

Option B is the correct answer because it directly addresses all requirements using Google Cloud's modern data governance tools. You use Data Catalog (governed by Dataplex) to create a taxonomy and policy tags (e.g., a "PII" tag). You apply this tag to the sensitive columns in your BigQuery table. Then, using IAM, you can grant the HR Analyst role access to the table but apply a data masking policy to the "PII" tag for that role. When an analyst queries the table, BigQuery dynamically masks the tagged columns for them at query time. The HR Admin role is granted full access without the masking policy. This provides fine-grained security without creating any copies of the data.

Option A is a valid but older approach. An authorized view could work, but it requires manually maintaining the view's SQL definition. Policy tags are more scalable and manageable, especially as the number of tables and policies grows.

Options C and D are incorrect because they both involve creating a new, separate dataset with masked data. This explicitly violates the requirement to "reduce data duplication."

Reference (Google Cloud Documentation Concepts):

This is the primary use case for column-level security in BigQuery. The official documentation shows how to "Restrict access with BigQuery column-level security" by creating a taxonomy and policy tags in Data Catalog. You then grant IAM permissions on these policy tags (roles/datacatalog.categoryFineGrainedReader) to different groups of users. For users who should see masked data, you do not grant them this role on the sensitive tags, and a data masking rule (e.g., nullification, hashing) can be applied. This entire governance framework can be managed centrally via Dataplex.

A hopping window is a type of sliding window that advances by a fixed period of time, producing overlapping windows. This is suitable for the scenario where the system needs to aggregate data for the last 30 seconds, every 2 seconds, and provide real-time updates. A Dataflow pipeline can implement the hopping window logic using Apache Beam, and process both streaming and batch data sources. Memorystore is a low-latency, in-memory data store that can serve the aggregated data to the visualization layer. BigQuery is not a good choice for this scenario, as it is not optimized for low-latency queries and frequent updates.

To ensure that resources are limited to only the europe-west3 region, you should set the organization policy constraint constraints/gcp.resourceLocations to in:europe-west3-locations. This policy restricts the deployment of resources to the specified locations, which in this case is the europe-west3 region. By setting this policy, you enforce location compliance across your Google Cloud resources, aligning with the best practices for data governance and regulatory compliance.