Google Cloud Professional Cloud Security Engineer Practice Exam

To ensure users can only access data in BigQuery during working hours, what should be implemented?

1. Custom IAM roles

2. Cloud Scheduler for data access

3. BigQuery Data Viewer role with IAM conditions

4. Time-based firewall rules

The correct answer is: BigQuery Data Viewer role with IAM conditions

Implementing the BigQuery Data Viewer role with IAM conditions is effective for ensuring that users can only access data during specific time frames, such as working hours. IAM conditions allow you to define conditions that must be met for a policy to take effect. In this case, you can specify a time-bound condition that restricts access to BigQuery during designated hours. This targeted approach ensures that access is granted only when it aligns with your defined working hours, enhancing data security without creating overly complex solutions. The other options do not provide the specific capability needed for time-restricted access in BigQuery. Custom IAM roles would allow more granular permission settings, but on their own, they do not offer a mechanism to enforce time-based access. A Cloud Scheduler can automate tasks on a schedule, but it does not directly control user access to BigQuery data during specific times. Time-based firewall rules are not relevant for managing access to data within BigQuery, as they pertain more to network security rather than data access permissions. Thus, using IAM conditions with the BigQuery Data Viewer role is the most appropriate solution for this scenario.