DEA-C01 Data Security and Governance Practice Question
A company uses AWS Lake Formation to manage fine-grained access to a data lake in Amazon S3. A data analyst needs to query a table in the AWS Glue Data Catalog that contains columns with sensitive data. The analyst must be able to see only non-sensitive columns and only rows where the region column equals 'US'. The analyst uses Amazon Athena for queries. Which Lake Formation permission model should the data engineer implement?
⚠ Common exam trap
The trap here is assuming that IAM policies or Athena views can enforce column-level and row-level security, when Lake Formation data filters are the correct mechanism for fine-grained access control in a data lake.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Grant the analyst SELECT permission on the table and create a data filter that includes only non-sensitive columns and a row filter for region = 'US'.
Lake Formation data filters provide column-level and row-level security by allowing you to specify which columns and rows a principal can access. By granting SELECT with a data filter that includes only non-sensitive columns and a row filter for region = 'US', the analyst is restricted appropriately. IAM policies, Athena views, and Glue job bookmarks do not enforce the required fine-grained access control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Grant the analyst SELECT permission on the table and use AWS Glue job bookmarks to filter sensitive data.
Why it's wrong here
Glue job bookmarks are used to track processed data during ETL jobs, not to enforce access control for queries. They do not restrict what data an analyst can see in Athena. This approach does not provide any column-level or row-level security.
- ✓
Grant the analyst SELECT permission on the table and create a data filter that includes only non-sensitive columns and a row filter for region = 'US'.
Why this is correct
Lake Formation data filters allow column-level and row-level security. Granting SELECT on the table with a data filter that specifies the allowed columns and a row filter expression restricts the analyst to only the permitted columns and rows. This meets the requirement precisely without granting broader access.
- ✗
Create a view in Athena that selects only non-sensitive columns and filters rows for region = 'US', and grant the analyst access to the view.
Why it's wrong here
Creating a view in Athena can restrict columns and rows, but it does not prevent the analyst from accessing the underlying table if they have permissions. The analyst could bypass the view and query the table directly. Lake Formation data filters enforce restrictions at the table level, which is more secure.
- ✗
Grant the analyst SELECT permission on the table and use an IAM policy to deny access to sensitive columns.
Why it's wrong here
IAM policies cannot enforce column-level or row-level access within a table in the Glue Data Catalog. Denying access to specific columns via IAM is not supported for Athena queries. Lake Formation data filters are required for fine-grained access control at the column and row level.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DEA-C01 question is part of Courseiva's 1,321-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.