You protected sensitive columns with policy tags and used an authorized dataset, but the analytics team still sees restricted columns. What should you do? (Choose two.)

The analytics team can still see restricted columns because policy tags, while applied, require explicit access control enforcement on the taxonomy itself. By enforcing access controls on the policy tag taxonomy, you directly control who can view data associated with those tags, ensuring the analytics team loses access to the sensitive columns. Removing Data Catalog fine-grained reader roles for sensitive policy tags from analytics team members is also necessary. This directly revokes their permission to view data classified under those specific policy tags, addressing the problem of them seeing restricted columns. Creating separate authorized datasets or replacing with an authorized view with row-level security are workarounds that don't directly address the misconfiguration of policy tag access. Removing the bigquery.dataViewer role is too broad and would prevent them from seeing any data in the dataset, not just the restricted columns.