DEA-C01 Data Security and Governance Practice Question

A data engineer is using AWS Lake Formation to manage access to a data lake stored in Amazon S3. The engineer grants a data analyst SELECT permission on a table in the AWS Glue Data Catalog. However, when the analyst queries the table using Amazon Athena, they receive an error that they are not authorized to access the underlying S3 data. What is the MOST likely reason?

⚠ Common exam trap

The trap here is assuming that granting table permissions in Lake Formation automatically grants access to the underlying S3 data, overlooking the need to register the data location.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The S3 bucket is not registered as a data location in Lake Formation.

For Lake Formation to manage access to data lake data, the S3 bucket must be registered as a data location. Without registration, Lake Formation cannot enforce or grant access to the underlying objects, resulting in authorization errors even when table permissions are granted. Registering the location enables Lake Formation to provide temporary credentials for data access.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The AWS Glue Data Catalog table is encrypted with SSE-KMS and the analyst lacks kms:Decrypt.
Why it's wrong here
While KMS permissions are needed for encrypted data, the error specifically mentions authorization to access S3 data, not decryption failure. The scenario does not mention encryption. The missing data location registration is the more direct cause.
✗
The analyst's IAM role lacks the lakeformation:GetDataAccess permission.
Why it's wrong here
lakeformation:GetDataAccess is required for Lake Formation to vend temporary credentials to access data. However, if the location is not registered, this permission alone would not help. The root cause is the missing registration, not the IAM permission.
✗
The analyst's IAM role does not have s3:GetObject permission on the S3 bucket.
Why it's wrong here
Lake Formation can manage S3 access through its own permissions, so explicit s3:GetObject in IAM is not required if Lake Formation grants are used. The error indicates that Lake Formation is not enforcing access correctly, likely due to a missing data location registration.
✓
The S3 bucket is not registered as a data location in Lake Formation.
Why this is correct
Lake Formation requires that the S3 location be registered as a data location to manage fine-grained access. Without registration, Lake Formation cannot grant access to the underlying data, even if table permissions are granted. The analyst would need direct S3 permissions or the location must be registered.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DEA-C01 Data Security and Governance Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question