An internal app must query BigQuery without requiring individual user authentication or granting users dataset access. How should the app securely access BigQuery?

A service account is the correct choice because it represents an application or virtual machine, not an individual user. By granting the service account specific dataset access, the internal app can query BigQuery without requiring individual user authentication or exposing user credentials. The private key securely authenticates the service account. Creating groups for users and granting them dataset access would still require individual user authentication. Integrating SSO and passing user credentials would also require individual user authentication and might expose user data. Creating a shared dummy user and storing credentials on disk is insecure and violates best practices for managing access.