DEA-C01 Data Security and Governance Practice Question

A data engineer is building an AWS Glue Data Catalog table that references an Amazon S3 bucket containing CSV files. The security team requires that column-level access be restricted so that only specific IAM principals can view the column containing personally identifiable information (PII). The engineer needs to implement this restriction without modifying the underlying data. Which combination of actions should the engineer take?

⚠ Common exam trap

Test-takers frequently confuse object-level S3 permissions or data masking with column-level access control, which requires Lake Formation.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use AWS Lake Formation to define column-level permissions on the table and grant access to the specific IAM principals.

AWS Lake Formation is designed for fine-grained access control on Data Catalog tables, including column-level permissions. It allows granting or denying access to specific columns for specific IAM principals without changing the data. IAM policies, S3 bucket policies, and Glue transforms operate at different levels and cannot achieve column-level restriction on the existing table.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Create an IAM policy that denies access to the S3 prefix containing the PII column.
Why it's wrong here
IAM policies control access to S3 objects, not columns within a table. Since the CSV files contain all columns together, denying access to the S3 prefix would block the entire table, not just the PII column. This approach is too coarse and does not satisfy the requirement for column-level restriction.
✗
Use AWS Glue Studio to create a transform that masks the PII column and write a new table.
Why it's wrong here
Masking the PII column by creating a new table modifies the data representation and does not restrict access for specific principals. It also duplicates data and may not meet the requirement to leave the underlying data unmodified. This approach does not provide column-level access control; it only alters the data, which is not what the security team asked for.
✗
Apply an S3 bucket policy that restricts access to objects based on object tags.
Why it's wrong here
S3 bucket policies with object tags operate at the object level, not the column level. Since the CSV files contain all columns, tagging objects cannot isolate the PII column. This method fails to provide the required column-level granularity and would either block all access or none, depending on the tags.
✓
Use AWS Lake Formation to define column-level permissions on the table and grant access to the specific IAM principals.
Why this is correct
AWS Lake Formation provides fine-grained access control, including column-level permissions, on Data Catalog tables. By registering the S3 location with Lake Formation and defining column-level grants, the engineer can restrict access to the PII column for specific principals. This meets the requirement without altering the data and is the recommended approach for column-level security in Glue Data Catalog.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DEA-C01 Data Security and Governance Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question