DEA-C01 Data Security and Governance Practice Question
A healthcare company stores patient records in an Amazon S3 bucket and uses AWS Lake Formation to manage access for multiple analytics teams. The compliance team requires that any column containing patient identifiers be masked by default for all users except a privileged data steward role. Which Lake Formation feature should the data engineer implement to meet this requirement?
⚠ Common exam trap
The trap here is assuming that data filters in Lake Formation can mask column values, when they actually restrict rows or hide columns entirely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Lake Formation tag-based access control policy that attaches LF-Tags to the sensitive columns and grants access only to the steward role.
Lake Formation tag-based access control enables attribute-based permissions where LF-Tags on columns determine access. Tagging sensitive columns and granting only the steward role access ensures all other users are denied those columns by default, effectively masking them. This is a native Lake Formation governance feature that integrates with analytics services and provides fine-grained control without duplicating data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable S3 Object Lock in governance mode on the bucket to prevent unauthorized access to sensitive objects.
Why it's wrong here
S3 Object Lock prevents object deletion or modification for a specified retention period. It does not control column-level access in Lake Formation and does not mask data for analytics users. Using Object Lock would not address the need to hide patient identifiers from unauthorized users; it only protects objects from being overwritten or deleted.
- ✗
Use AWS Glue DataBrew to create a masking recipe that anonymizes the sensitive columns before granting access.
Why it's wrong here
AWS Glue DataBrew can transform and mask data, but it operates on data as part of a transformation job, producing a new dataset. It does not enforce dynamic column-level access control at query time for multiple teams. The requirement is for continuous governance of existing data, not a one-time masking job, so DataBrew is not the appropriate solution.
- ✗
Configure a data filter that excludes sensitive columns from the table definition.
Why it's wrong here
Data filters in Lake Formation restrict row-level access by defining a filter expression, and they can also exclude columns from the visible table. However, they do not automatically mask column values; they simply hide columns entirely from users. Since the requirement is to mask identifiers by default for all users except the steward, hiding columns would prevent legitimate analysis. Masking requires a different mechanism.
- ✓
Create a Lake Formation tag-based access control policy that attaches LF-Tags to the sensitive columns and grants access only to the steward role.
Why this is correct
Lake Formation tag-based access control (LF-TBAC) allows you to attach LF-Tags to databases, tables, and columns, and then grant permissions based on those tags. By tagging sensitive columns and granting access only to the steward role, all other users are denied access to those columns by default. This satisfies the requirement to mask by default while allowing the steward full access.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,321 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.