Google SecOps Professional Engineer Practice Test

The key idea is that the identity performing the export must have write access to the target dataset. The SecOps export runs under a service account, and if that service account doesn’t have permission to write data into the dataset, the export can complete without actually inserting any rows, leaving the dataset empty. Granting the SecOps service account the Data Editor role on the dataset gives it the necessary rights to insert and manage data within that dataset, enabling the export to populate it as expected. This is the precise, least-privilege permission needed for the write operation. The other options don’t address the problem: assigning a user on the project doesn’t change the service account’s dataset permissions; granting serviceAccountUser to itself doesn’t grant write access; and setting a retention period has no impact on whether data can be written to the dataset.