DEA-C01 Data Security and Governance Practice Question
A data engineer manages an AWS Lake Formation governed data lake. Analysts in the finance department must query only the rows in a shared Amazon S3 table where the region column equals 'EMEA', while analysts in the marketing department must see all rows but must not see the customer_email column. Which TWO Lake Formation configurations should the data engineer implement to meet these requirements? (Choose two.)
⚠ Common exam trap
The trap here is reaching for IAM or S3 object metadata to express row predicates, when those layers cannot filter individual rows inside a data file and Lake Formation data filters are the intended control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a data filter on the table that excludes the customer_email column and grant SELECT on the table with that data filter to the marketing analyst role.
Lake Formation data filters are the native mechanism for row-level and column-level security. A data filter with a row expression scopes which rows a principal can read, and a data filter with an included column list scopes which columns are visible. Granting SELECT with the appropriate data filter to each analyst role enforces both requirements across integrated engines without copying or duplicating the underlying S3 objects.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a data filter on the table that excludes the customer_email column and grant SELECT on the table with that data filter to the marketing analyst role.
Why this is correct
A Lake Formation data filter can specify an included column list that omits customer_email. Granting SELECT with that column-scoped data filter to the marketing role means queries through integrated engines return all rows but cannot project the excluded column. This implements the column-level restriction without duplicating the underlying S3 data.
- ✗
Define an AWS Glue Data Catalog table property named column.filter with the value customer_email and a table property row.filter with the value region='EMEA', then grant DESCRIBE to both roles.
Why it's wrong here
There are no Data Catalog table properties named column.filter or row.filter that Lake Formation interprets as access controls. Inventing arbitrary table properties has no effect on query results, and DESCRIBE only allows metadata visibility. Row and column enforcement requires data filters attached to Lake Formation grants, not table properties.
- ✓
Create a data filter on the table that includes a row filter expression of region = 'EMEA' and grant SELECT on the table with that data filter to the finance analyst role.
Why this is correct
Lake Formation data filters bundle a row filter expression with an optional column list. Granting SELECT with a data filter that contains region = 'EMEA' ensures the finance role can only retrieve EMEA rows, even when queries are run through Amazon Athena or Amazon Redshift Spectrum. This is the supported way to enforce row-level access in Lake Formation.
- ✗
Register the S3 location with Lake Formation in hybrid access mode and grant the analysts ALL permissions so that IAM policies alone control row and column visibility.
Why it's wrong here
Hybrid access mode lets existing IAM permissions continue to work alongside Lake Formation, but granting ALL does not itself enforce row or column restrictions. IAM policies operate at the S3 object and API level and cannot express a predicate such as region = 'EMEA' or hide a single column within a table.
- ✗
Attach an IAM policy to the finance analyst role that denies s3:GetObject on any S3 prefix whose object metadata does not contain a region tag of EMEA.
Why it's wrong here
S3 object metadata is not queryable as a row-level predicate, and Lake Formation governed tables are accessed through the Lake Formation permission model rather than direct S3 GETs by analysts. This policy would also block legitimate access paths and cannot filter individual rows inside a single Parquet or ORC object, so it does not meet the row-level requirement.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,321 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.