Google Cloud Data Engineer Professional Practice Exam

1. 1.A healthcare company stores patient records in BigQuery. Analysts need to run aggregate queries on a table containing a column with patient national identifiers, but must never see the raw values. The company wants the least operationally complex approach that keeps a single copy of the data. What should you do?

   • ACreate a second table with the identifier column removed and grant analysts access only to that table.
   • BApply a policy tag with a data masking rule to the column and grant analysts the Masked Reader role.Correct answer
   • CExport the table to Cloud Storage, strip the column with Dataflow, and reload the result into BigQuery.
   • DRun a Cloud DLP de-identification job that writes hashed identifiers into a new dataset for analysts.

   Why

   BigQuery dynamic data masking applies a masking policy tag to the column and evaluates it at query time based on the caller's IAM role, so a single physical copy serves both privileged and restricted readers. Creating a redacted copy duplicates storage and drifts. Authorized views can hide the column but require maintaining a parallel view surface. Cloud DLP de-identification into a new table is a batch transformation, not a query-time control.

2. 2.A European bank must guarantee that a BigQuery dataset holding customer transactions is never processed or stored outside the EU, and that no engineer can create a resource violating this rule. What should you configure?

   • AThe BigQuery dataset location set to the EU multi-region at creation time.
   • BA VPC Service Controls perimeter around the project that contains the dataset.
   • CAn organization policy with the gcp.resourceLocations constraint limited to EU regions.Correct answer
   • DIAM conditions that grant dataset access only to principals whose access level is in the EU.

   Why

   The gcp.resourceLocations organization policy constraint restricts which regions resources may be created in, and it is enforced at resource-creation time across the whole folder or organization, so no engineer can bypass it. Setting the dataset location only fixes that one dataset. IAM conditions on principals do not restrict where new resources land. VPC Service Controls prevents data exfiltration across a perimeter but does not constrain the region a resource is created in.

3. 3.Your organization requires that the encryption keys protecting a BigQuery dataset be rotated on your own schedule and be revocable so that data becomes unreadable immediately. Which approach meets the requirement?

   • AAttach policy tags to all columns and manage access through Data Catalog taxonomies.
   • BRely on Google-managed default encryption and request key rotation through a support case.
   • CEncrypt every field in the application before loading it into BigQuery.
   • DConfigure the dataset to use a customer-managed encryption key from Cloud KMS with a rotation period.Correct answer

   Why

   Customer-managed encryption keys in Cloud KMS let you set a rotation period and disable or destroy the key version, which makes the data unreadable without deleting it. Google-managed default encryption gives you no control over rotation or revocation. Client-side encryption before load meets the control goal but breaks BigQuery's ability to query the values and is far more complex. Column-level policy tags govern access, not encryption keys.

4. 4.A data platform team runs identical pipelines in development and production. Developers must be able to deploy freely in development but must never read production data or modify production pipelines. What is the recommended architecture?

   • AUse one project with a development dataset and a production dataset, granting dataset-level roles.
   • BUse one project and distinguish environments with resource labels checked by a monitoring alert.
   • CUse separate Google Cloud projects for development and production, with distinct IAM bindings in each.Correct answer
   • DUse one project and apply IAM conditions that match resource names beginning with prod_.

   Why

   Separating environments into distinct projects gives a hard IAM and quota boundary: developers hold roles in the development project only, so no grant in production can be reached accidentally. Separate datasets in one project still leaves project-level roles and shared quota. Labels and tags are metadata and enforce nothing. A single project with conditional bindings on dataset name is fragile and easily bypassed by new resources.

5. 5.An analytics team needs to know, for every BigQuery table in the organization, which upstream tables and pipelines produced it, without instrumenting each job by hand. What should you use?

   • AA Cloud Logging sink that exports BigQuery audit logs to a table.
   • BQueries against INFORMATION_SCHEMA.JOBS in each project.
   • CDataplex Universal Catalog data lineage.Correct answer
   • DA manually curated dependency spreadsheet reviewed each sprint.

   Why

   Dataplex Universal Catalog data lineage automatically captures lineage for supported sources such as BigQuery and Dataflow, so the graph is populated without per-job instrumentation. INFORMATION_SCHEMA.JOBS holds query history but does not present a lineage graph and misses non-query producers. Cloud Logging sinks give raw audit events, not resolved lineage. A manually maintained spreadsheet does not scale and drifts.

Practice all 65 questions

Frequently asked questions