Exam Associate Cloud Engineer topic 1 question 130 discussion

I think B is the answer

Correct Answer is (B): Sorry, I copied/pasted the the wrong statement. This is the proper explanation regarding to Big Query Data Viewer Role. The resource that you need to get access is in the other project. roles/bigquery.dataViewer BigQuery Data Viewer When applied to a table or view, this role provides permissions to: Read data and metadata from the table or view. This role cannot be applied to individual models or routines. When applied to a dataset, this role provides permissions to: Read the dataset's metadata and list tables in the dataset. Read data and metadata from the dataset's tables. When applied at the project or organization level, this role can also enumerate all datasets in the project. Additional roles, however, are necessary to allow the running of jobs.

BigQuery Data Viewer (roles/bigquery.dataViewer) When applied to a table or view, this role provides permissions to: Read data and metadata from the table or view. This role cannot be applied to individual models or routines. https://cloud.google.com/bigquery/docs/access-control

Big Query Data Viewer Role allows to read data only in the Cloud Console, you cannot use SQL to select or aggregate data, I assume the app will need to run jobs. How would you write such an app? Please correct me if I am wrong.

To read data from a BigQuery dataset, you only need to grant the App Engine Service account the role of BigQuery Data Viewer.

B B B B

As the question clearly says - 'read' 'You do not have access to this project, but you want your application to be able to READ data from the BigQuery dataset' Awnser is B

A is too permissive. This role includes BigQuery Data Viewer permissions but also the ability to create, run, and manage BigQuery jobs. Your application only needs to read data, not manipulate it. B grants read-only access to BigQuery datasets and tables, which perfectly aligns with the requirement of the App Engine service only needing to visualize data.

To see data, you need either BigQuery User or BigQuery Data Viewer roles You CANNOT see data with BigQuery Job User roles

B es la correcta. Si alguien tiene el listado completo de preguntas, me las envia a [email protected] , rindo en 10 dias gracias!

role/bigquery.dataViewer

B - a viewer can query, aggregate and visual data

Ans is B . Ask the other team to grant your default App Engine Service account the role of BigQuery Data Viewer: The BigQuery Data Viewer role provides permissions to view and list data in BigQuery. This includes reading data from tables and views in a dataset. If you need your application to read data from the BigQuery dataset in the other project, this is the appropriate role to be granted to your service account by the other team. Reason option A is incorrect Ask the other team to grant your default App Engine Service account the role of BigQuery Job User: The BigQuery Job User role allows a user to run BigQuery jobs, which includes query jobs. However, this role does not grant permission to read data in BigQuery tables or datasets. It's useful for submitting jobs but not sufficient for accessing data.

Role of BigQuery Data Viewer: The BigQuery Data Viewer role (roles/bigquery.dataViewer) includes permissions to view and query data within BigQuery datasets. This role is sufficient for an application that needs read access to BigQuery datasets, such as for aggregation and visualization purposes.

Selected Answer: B "BigQuery Job User: Provides permissions to run jobs, including queries, within the project." So it is not giving access to read BigQuery Dataset! https://cloud.google.com/bigquery/docs/access-control

The requirements are to - aggregating and visualizing data from BigQuery - the BigQuery Data Viewer (roles/bigquery.dataViewer) role is likely the most appropriate. This role will allow the App Engine service to read and visualize the data without permission to modify it. If the app service needs more than just read access, such as the ability to modify data or execute specific types of queries, we might consider the Data Editor or Data User roles. However, always adhere to the principle of least privilege, granting only the minimum permissions necessary for your service to function as intended.

A seems more correct , as A give you both required access i.e aggragets and visualizes data from BQ