A SecOps report export to a BigQuery dataset runs successfully but the dataset remains empty. Which action should you take to fix the export with correct permissions?

• A. Grant the SecOps service account dataEditor on the dataset.
• B. Grant the user who scheduled the report roles/bigquery.dataEditor on the project.
• C. Grant the SecOps service account roles/iam.serviceAccountUser to itself.
• D. Set a retention period for the BigQuery export.

Answer: (A)

The key idea is that the identity performing the export must have write access to the target dataset. The SecOps export runs under a service account, and if that service account doesn’t have permission to write data into the dataset, the export can complete without actually inserting any rows, leaving the dataset empty.

Granting the SecOps service account the Data Editor role on the dataset gives it the necessary rights to insert and manage data within that dataset, enabling the export to populate it as expected. This is the precise, least-privilege permission needed for the write operation.

The other options don’t address the problem: assigning a user on the project doesn’t change the service account’s dataset permissions; granting serviceAccountUser to itself doesn’t grant write access; and setting a retention period has no impact on whether data can be written to the dataset.