A retailer curates a sales feed in BigQuery and wants several outside partners to query it. The retailer must be able to cut off any partner immediately and see which partner ran which queries. Which approach satisfies both requirements?
Show answer and explanation
Answer: B
Analytics Hub lets a publisher create a data exchange and list shared datasets that subscribers reach as linked datasets. The data stays in the publisher's project, so access remains centrally controlled. The publisher can remove a subscriber or withdraw a listing quickly, and BigQuery audit logs record query activity by each consumer. Long-lived keys, public buckets and email attachments each either leave the publisher without per-partner revocation or create uncontrolled copies of the data.
Why the other options are wrong
- A. Long-lived service account keys are a security risk and are hard to revoke cleanly across many external parties. Monthly rotation does not give the immediate cutoff and per-query visibility the scenario asks for.
- C. A public read bucket exposes the files to anyone who has the URL, not just approved partners. The publisher cannot enforce per-partner revocation or see who read which file.
- D. Email attachments create copies that cannot be recalled once sent. The retailer loses control over access and cannot track usage, so this option fails the revocation requirement.