Exam Professional Data Engineer topic 1 question 76 discussion

I have no idea why so many upvotes on this answer: 1) archived doesn't mean immutable and cloud storage is not immutable too. 2) auditable means viewable for authorized personel - and in this case not changes need to be monitored but any access. 3) with option D it is easy to go around logging - you can add another access to the bucket read the data remove the access and no one will ever know that you accessed the data. 4) option D is much more difficult - you need to application on AppEngine to log the data and provide access for users. 5) option D doesn;t explain where and how it stores the audit data - it could be accessed and modified from some side app/service.

There is no option for archiving with BQ

The question has no mention of ANALYZE.. BQ is not correct. I would go with D.

That was my thought, either B or D could work but D it’s a little bit odd create an app to do something that could be achieved natively gcp

I was about to say the same thing. Why go through that stress?

gpt: You are correct that option A does not provide an auditable record of access to the data, as it only addresses data security through encryption. Option C provides auditability through Cloud SQL Admin activity logs, but it may not be the best option as it requires additional setup and management. Option D is a feasible solution, but as you mentioned, it requires additional setup and maintenance of the AppEngine service. It also may not provide a comprehensive audit log of all data access. Option B, storing the data in a BigQuery dataset that is viewable only by authorized personnel and using the Data Access log to provide auditability, is the most appropriate option as it provides built-in logging of all data access and allows you to control access to the dataset using IAM roles. Therefore, it provides both data security and auditable access to the data. /// ok let it be B

A. Encrypted on Cloud Storage with user-supplied encryption keys. A separate decryption key will be given to each authorized user. is a good option for data security but it does not provide an auditable record of access to the data. C. In Cloud SQL, with separate database user names to each user. The Cloud SQL Admin activity logs will be used to provide the auditability. is also a good option for data security but it does not provide an auditable record of access to the data. D. In a bucket on Cloud Storage that is accessible only by an AppEngine service that collects user information and logs the access before providing a link to the bucket. is also a good option but it requires additional setup and maintenance of the AppEngine service, and it may not provide an auditable record of access to the data.