DEA-C01 Data Security and Governance Practice Question
A company wants to use AWS Lake Formation to manage permissions on a data lake. What is the primary benefit of using Lake Formation for data security?
⚠ Common exam trap
Test-takers frequently assume Lake Formation replaces IAM entirely or handles encryption, but the exam tests the understanding that Lake Formation is a complementary governance layer for fine-grained access control, not a replacement for IAM or encryption services.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Centralized fine-grained access control to data in S3, Redshift, and RDS.
AWS Lake Formation centralizes fine-grained access control for data lakes, allowing administrators to define column-level, row-level, and cell-level permissions on data stored in Amazon S3, and also extend those policies to Amazon Redshift and Amazon RDS via integrated resource links. This eliminates the need to manage separate IAM policies for each service, providing a single point of governance for data security across the data lake ecosystem.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Automatically encrypts data at rest and in transit.
Why it's wrong here
Encryption is managed separately.
- ✗
Replaces IAM for all data access policies.
Why it's wrong here
Lake Formation works with IAM, not replace it.
- ✗
Provides a unified view of data across all AWS regions.
Why it's wrong here
Not a primary security benefit.
- ✓
Centralized fine-grained access control to data in S3, Redshift, and RDS.
Why this is correct
Lake Formation provides column and row-level security.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DEA-C01 question is part of Courseiva's 1,711-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.