DEA-C01 Data Security and Governance Practice Question
A company uses Amazon Redshift for data warehousing. The security team requires that all queries be logged for audit and that sensitive columns be masked for non-privileged users. Which THREE steps should the data engineer take? (Choose 3)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement row-level security using Redshift's row-level security feature.
The correct answers are A, B, and E. Option A: Redshift supports row-level security, which restricts access to rows based on user authorization, meeting the requirement to mask sensitive data for non-privileged users. Option B: Enabling audit logging on the Redshift cluster captures all queries for audit purposes, satisfying the logging requirement. Option E: Creating views that expose only non-sensitive columns and granting access to those views is a common method to implement column-level masking in Redshift. Option C is incorrect because AWS CloudTrail logs API calls to Redshift (e.g., cluster operations) but does not log SQL queries; for query logging, audit logging must be enabled. Option D is incorrect because IAM roles control access to the Redshift database itself but cannot restrict access to specific columns; column-level control is achieved through views or column-level security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement row-level security using Redshift's row-level security feature.
Why this is correct
Row-level security filters rows based on user.
- ✓
Enable audit logging on the Redshift cluster.
Why this is correct
Audit logging records all queries.
- ✗
Enable CloudTrail logging for Redshift data events.
Why it's wrong here
CloudTrail does not log SQL queries.
- ✗
Use IAM roles to restrict access to specific columns.
Why it's wrong here
IAM cannot restrict columns in Redshift.
- ✓
Create views that expose only non-sensitive columns and grant access to those views.
Why this is correct
Views provide column-level security.
Go deeper
Related to this question
About these practice questions
One of 1,711 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.