A data engineer must restrict a shared BigQuery table so each analyst sees only the rows for regions assigned to them, with the assignment determined by the analyst's identity. Which BigQuery feature does this?
Show answer and explanation
Answer: D
BigQuery row access policies attach a filter predicate to a table, and the predicate can reference SESSION_USER() or a mapping of user assignments, so each querier sees only the rows they are allowed to see. The data stays in one table and access changes are made in the policy. Separate per-region tables multiply maintenance, column-level security hides columns rather than filtering rows, and project-level roles grant access to the entire dataset.
Why the other options are wrong
- A. Per-region tables duplicate data and force every new assignment to change grants on many tables, which does not scale and is harder to audit.
- B. Column-level security decides which columns a user can read, so it could hide the region column, but it would not limit which rows the analyst sees.
- C. Project-level viewer roles expose everything in the scoped resources, so they cannot restrict individual rows by region for different analysts.