DEA-C01 Data Security and Governance Practice Question
A data engineer is using AWS Lake Formation to manage access to a data lake in Amazon S3. The engineer needs to grant a specific IAM role access to only the columns containing non-sensitive data in a table stored in the AWS Glue Data Catalog. The role should not have access to sensitive columns. What should the engineer do?
⚠ Common exam trap
The trap here is assuming that IAM policies or Glue Data Catalog resource policies can enforce column-level permissions, when in fact only Lake Formation data filters provide that capability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Lake Formation data filter that excludes the sensitive columns, and grant the IAM role SELECT permission on the table with the data filter applied.
AWS Lake Formation provides column-level security through data filters. By creating a data filter that excludes sensitive columns and granting SELECT with that filter, the engineer ensures the IAM role can only access the permitted columns. This is the native and most secure method for fine-grained access control in Lake Formation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Grant the IAM role SELECT permission on the table, and then apply an IAM policy that denies access to the columns with sensitive data.
Why it's wrong here
IAM policies cannot enforce column-level access control on Lake Formation-managed tables. IAM policies apply to AWS API actions, not to individual columns within a table. Once SELECT is granted on the table via Lake Formation, the role can access all columns unless Lake Formation column-level permissions are used. An IAM deny would not override Lake Formation permissions in this context.
- ✗
Use AWS Glue Data Catalog resource policies to deny access to the sensitive columns for the IAM role.
Why it's wrong here
AWS Glue Data Catalog resource policies are used to manage access to Data Catalog resources like databases and tables, but they do not support column-level permissions. They operate at the database, table, or catalog level. Therefore, they cannot be used to selectively deny access to specific columns; that requires Lake Formation column-level security.
- ✓
Create a Lake Formation data filter that excludes the sensitive columns, and grant the IAM role SELECT permission on the table with the data filter applied.
Why this is correct
Lake Formation data filters allow column-level and row-level access control. By creating a data filter that excludes sensitive columns and granting SELECT with that filter, the IAM role can access only the non-sensitive columns. This is the intended way to implement fine-grained access control in Lake Formation and meets the requirement precisely.
- ✗
Create a view in Amazon Athena that selects only the non-sensitive columns, and grant the IAM role access to the view instead of the table.
Why it's wrong here
Creating a view in Athena can restrict columns, but it does not prevent the IAM role from accessing the underlying table if the role has permissions on the table. The requirement is to ensure the role cannot access sensitive columns at all. Unless Lake Formation permissions on the table are restricted, the role could still query the table directly. Views are a workaround but not a secure access control mechanism by themselves.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,321 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.