AIF-C01 Practice Question: Security, Compliance, and Governance for AI Solutions
A data governance team wants to enforce fine-grained access control on data in an Amazon S3 data lake used by multiple business units for AI training. Which AWS service should they use to define and manage data permissions at the table and column level?
⚠ Common exam trap
The trap is choosing IAM because it is the default AWS access control service — candidates miss that IAM cannot enforce table/column-level permissions on data lake tables, which is the specific requirement Lake Formation exists to solve.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Lake Formation
AWS Lake Formation is purpose-built to define and manage fine-grained access control (table, column, row, and cell level) on data stored in Amazon S3 data lakes. It provides a centralized permission model that works across analytics and AI/ML services, making it the correct choice for multi-business-unit governance. IAM alone cannot express column-level permissions on S3 data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Identity and Access Management (IAM)
Why it's wrong here
IAM policies operate at S3 object, prefix and bucket granularity; they cannot express table- or column-level grants over Glue Data Catalog tables. IAM would be correct for controlling access to the bucket itself, while Lake Formation manages finer data permissions.
- ✓
AWS Lake Formation
Why this is correct
Lake Formation provides table- and column-level permission grants over S3 data registered in its Data Catalog, meeting the fine-grained access requirement. IAM policies alone cannot restrict individual columns, so Lake Formation is the only service here that enforces column-level control across business units.
- ✗
AWS CloudTrail
Why it's wrong here
CloudTrail records API activity for auditing and compliance; it defines no permissions at all. It would be the right choice for tracing who accessed which S3 object, but table- and column-level grants in a data lake belong to AWS Lake Formation.
- ✗
Amazon Macie
Why it's wrong here
Macie discovers and classifies sensitive data such as PII in S3, it does not define table- or column-level permissions. It is tempting because it governs data visibility, but that governance is detective classification, not enforcement. Lake Formation grants fine-grained access control at table and column level.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 862 original AIF-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This AIF-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AIF-C01 exam.