DEA-C01 Data Security and Governance Practice Question
A data engineer manages an AWS Lake Formation governed data lake. Analysts query tables through Amazon Athena and must see only rows where the region column equals their assigned region, while column-level restrictions must also hide a national ID column. The engineer grants table SELECT to the analysts' IAM role in Lake Formation. What should the engineer configure next?
⚠ Common exam trap
The trap here is believing that IAM policies can enforce row or column restrictions on Lake Formation tables, when those controls live in Lake Formation grants.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Lake Formation data filter that includes a row filter expression on region and excludes the national ID column, then grant SELECT with that data filter to the role.
Lake Formation data filters are the mechanism for combining row-level expressions with column inclusion or exclusion in a single SELECT grant. Granting the filter to the analysts' IAM role enforces both restrictions on the governed table, so analysts see only their region rows and never the national ID column, without duplicating tables or views.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attach an IAM policy to the analysts' role that denies access to the national ID column and uses a condition on the region tag.
Why it's wrong here
IAM policies cannot express column-level or row-level restrictions on Lake Formation tables; those decisions are enforced by Lake Formation permissions, not by IAM condition keys on the table. A deny on a column name would not map to the underlying data catalog structure and would not filter rows.
- ✗
Create separate Athena views for each region and revoke direct table access, relying on view definitions for the row and column limits.
Why it's wrong here
Views can restrict columns and rows, but the scenario specifies Lake Formation governance and existing table grants through Lake Formation. Relying on views bypasses the centralized permission model, requires maintenance per region, and does not use Lake Formation data filters to enforce the restrictions at the table level.
- ✗
Enable Amazon Athena workgroup query result reuse and rely on Athena to mask the national ID column automatically.
Why it's wrong here
Query result reuse is a performance and cost feature that caches results; it does not enforce row or column security. Athena does not automatically mask columns based on workgroup settings, so analysts could still read the national ID column and rows outside their region.
- ✓
Create a Lake Formation data filter that includes a row filter expression on region and excludes the national ID column, then grant SELECT with that data filter to the role.
Why this is correct
Lake Formation data filters support both row-level filter expressions and column inclusion or exclusion in a single grant. Granting SELECT with the data filter applies the row predicate and hides the excluded column for that principal, which is exactly the granular control the scenario requires without duplicating tables.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,321 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.