DEA-C01 Data Security and Governance Practice Question
A company uses AWS Glue to catalog data in Amazon S3. The data includes personally identifiable information (PII). The security team requires that PII be masked when queried by users who are not data owners. Which AWS service should be used to enforce this requirement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Lake Formation to define column-level security and data masking.
AWS Lake Formation provides fine-grained access control and column-level masking for data cataloged in the Glue Data Catalog, enabling PII masking at query time. Option A is wrong because Amazon Macie discovers and classifies PII but does not automatically redact data from S3 objects. Option B is wrong because IAM policies with condition keys can restrict access but cannot perform data masking. Option D is wrong because Amazon S3 Object Lambda can transform data at the object level but not at the query level for dynamic masking.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Amazon Macie to automatically redact PII from S3 objects.
Why it's wrong here
Macie discovers and classifies data but does not enforce access controls.
- ✗
Use IAM policies with condition keys to restrict access based on tags.
Why it's wrong here
IAM policies cannot mask data within query results.
- ✓
Use AWS Lake Formation to define column-level security and data masking.
Why this is correct
Lake Formation provides column-level permissions and dynamic masking.
- ✗
Use Amazon S3 Object Lambda to transform data on the fly.
Why it's wrong here
S3 Object Lambda operates at the object level, not for SQL queries.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,711 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.