DEA-C01 Data Operations and Support Practice Question
A company uses AWS Lake Formation to manage data lake permissions. A data engineer needs to grant a group of analysts SELECT permission on a set of tables in the 'analytics' database, but only for columns that are not classified as 'PII'. Which approach should the engineer use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Lake Formation tag-based access control (LF-TBAC) to grant SELECT on columns without the 'PII' tag.
Lake Formation tag-based access control (LF-TBAC) allows granting SELECT permission on columns that do not have the 'PII' tag, enabling fine-grained column-level access. Option A is incorrect because granting SELECT on the entire database would include all columns, including those classified as PII. Option B is incorrect because IAM policies cannot enforce column-level restrictions based on tags within Lake Formation tables. Option C is incorrect because S3 bucket policies operate at the object level and cannot restrict access to specific columns within a table.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Grant SELECT on the entire database and rely on analysts to avoid PII columns.
Why it's wrong here
This grants access to all columns, including PII, which violates the requirement.
- ✗
Create an IAM policy that denies access to PII columns.
Why it's wrong here
IAM policies cannot restrict access at the column level in Lake Formation.
- ✗
Use an S3 bucket policy to restrict access to objects containing PII data.
Why it's wrong here
S3 bucket policies operate at the object level, not column level, and are not suitable for fine-grained access.
- ✓
Use Lake Formation tag-based access control (LF-TBAC) to grant SELECT on columns without the 'PII' tag.
Why this is correct
LF-TBAC allows column-level permissions by matching tags on columns with tags on the grant.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,711 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.