A fintech's data team needs development, test, and production environments with identical table definitions, and production data must never be reachable from development. Which setup is recommended?
Show answer and explanation
Answer: C
Separate projects give each environment its own IAM boundary, quotas, and audit trail, so production data cannot be reached from development by accident. Defining datasets, tables, and pipelines in version-controlled infrastructure-as-code, such as Terraform or Dataform, keeps the definitions identical across environments without manual copying. Prefixes and shared datasets rely on naming alone for separation. Sharing a project between test and production removes the boundary that matters most.
Why the other options are wrong
- A. Table name prefixes are a naming convention, not an access boundary. One misconfigured grant on the dataset exposes every environment at once.
- B. Separate datasets inside one project still share project-level IAM, quotas, and service accounts. Shared service accounts in particular let development code act with production privileges.
- D. Splitting environments across organizations is heavier than needed, and sharing a project between test and production breaks the boundary the requirement depends on.