Masking sensitive fields and controlling who can see them

Google Cloud lets you protect sensitive analytics data through layered IAM permissions, BigQuery's built-in column/row-level security, and Sensitive Data Protection (formerly Cloud DLP) for discovering and de-identifying PII before or during analysis. Exam questions typically test which control (IAM role, policy tag, authorized view, or DLP transformation) fits a given masking or access scenario. Understand that IAM controls *who* can access a resource, while column/row-level security and DLP control *what data* they see once granted access.

Must-know

• IAM at the project/dataset/table level (e.g., BigQuery dataViewer, dataEditor, dataOwner) controls coarse-grained access; use the principle of least privilege and prefer predefined roles over primitive roles.
• BigQuery column-level security uses Data Catalog policy tags plus IAM (Data Catalog fine-grained reader role) to restrict which columns a user can query, independent of table-level access.
• Row-level security in BigQuery is implemented via CREATE ROW ACCESS POLICY, filtering rows returned based on the querying user's identity or group.
• Authorized views and authorized datasets let you share query results without granting underlying table access, useful for masking logic implemented in SQL.
• Sensitive Data Protection (Cloud DLP) can inspect data (structured or unstructured) to detect infoTypes like emails or credit card numbers, and de-identify it using techniques such as masking, tokenization, format-preserving encryption, or date shifting via inspect/de-identify templates and jobs.
• Cloud DLP de-identification is typically applied in a pipeline (e.g., Dataflow) before loading into BigQuery, whereas column/row-level security and IAM control access after the data is already stored, know which layer a scenario is asking about.

Coverage checked against the published exam guide on Aug 11, 2026.

These are independent practice questions, written against this certification's published exam guide. They are not the certification vendor's own questions, and not the real exam.