DEA-C01 Data Security and Governance Practice Question
A financial services company uses Amazon Athena to query a data lake in S3. The data lake contains sensitive financial transactions. The security team has implemented row-level security using views in AWS Glue Data Catalog. Each view is defined with a WHERE clause that filters rows based on the user's IAM role using a custom tag. However, when a data analyst runs a SELECT * FROM view_name in Athena, the query returns all rows, ignoring the row-level filter. The analyst's IAM role has the tag 'department=analytics'. The view was created with a filter condition 'department = current_user_department()', where current_user_department() is a user-defined function that extracts the department tag from the caller's IAM role. The function is defined in the Glue Data Catalog. What is the most likely reason the filter is not applied?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The view is not defined with the filter condition properly; the function current_user_department() may not be invoked correctly in the view definition.
The most likely reason is that the user-defined function current_user_department() is not invoked correctly in the view definition. In Athena, views store the SQL logic, and when queried, the filter condition is evaluated. If the function is not registered properly or is not supported in view filters, the query may ignore it. Option A is incorrect because the function is already defined in the Glue Data Catalog. Option B is incorrect because Athena does support user-defined functions in views. Option C is incorrect because the analyst's role does have the tag.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user-defined function current_user_department() is not registered in the Glue Data Catalog.
Why it's wrong here
It is registered as stated.
- ✗
Athena does not support user-defined functions in views.
Why it's wrong here
Athena supports UDFs in views.
- ✗
The IAM role does not have the tag 'department=analytics'.
Why it's wrong here
The role has the tag.
- ✓
The view is not defined with the filter condition properly; the function current_user_department() may not be invoked correctly in the view definition.
Why this is correct
The function must be used in the view's SELECT statement.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DEA-C01 question is part of Courseiva's 1,711-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.