DEA-C01 Data Operations and Support Practice Question
A company uses AWS Lake Formation to manage access to data in S3. A data analyst reports being unable to query a table in Amazon Athena, receiving an 'Access Denied' error. The analyst has SELECT permission on the table in Lake Formation. What additional configuration is MOST likely causing the issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The IAM role used by Athena does not have S3 GetObject permission on the underlying data
In AWS Lake Formation, even when a user has SELECT permission on a table, the IAM role that Athena uses must have S3 GetObject permission on the underlying data files. Lake Formation manages permissions at the metadata level, but the actual data access is enforced by S3 bucket policies and IAM. Without GetObject permission, Athena fails with 'Access Denied'. Option A is incorrect because Athena typically has access to the Glue Data Catalog if the table is visible; the error is about data access. Option C is incorrect because SELECT permission usually includes DESCRIBE, and the error message is about access denied, not missing describe. Option D is incorrect because the table is registered with Lake Formation since the analyst has SELECT permission.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Athena does not have permission to access the Glue Data Catalog
Why it's wrong here
Athena uses the Data Catalog; this is typically configured.
- ✓
The IAM role used by Athena does not have S3 GetObject permission on the underlying data
Why this is correct
Lake Formation grants SELECT, but S3 bucket policies or IAM may still block access.
- ✗
The analyst does not have DESCRIBE permission
Why it's wrong here
DESCRIBE is needed for metadata, but the error is Access Denied, not missing metadata.
- ✗
The table is not registered with Lake Formation
Why it's wrong here
If the table is not registered, Lake Formation cannot manage it, but the error would be different.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DEA-C01 question is part of Courseiva's 1,711-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.