DEA-C01 Data Ingestion and Transformation Practice Question
An organization uses AWS Lake Formation to manage a data lake in S3. A new data engineer needs to create a Glue ETL job that reads from a Lake Formation-managed table. The engineer has been granted SELECT permission on the table via Lake Formation. However, the job fails with an AccessDenied error. What is the MOST likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The IAM role used by the Glue job does not have Lake Formation permissions.
The IAM role used by the Glue job must have Lake Formation permissions (such as lakeformation:GetDataAccess) to access the table. Without these permissions, the job will fail with an AccessDenied error even if the S3 bucket policy allows access. Option B is incorrect: S3 bucket policies are not the primary issue because Lake Formation manages fine-grained access; the role must have Lake Formation permissions. Option C is incorrect: the table is already registered with Lake Formation if it is a Lake Formation-managed table; registration is a prerequisite for granting permissions. Option D is incorrect: Lake Formation does not require a specific VPC; Glue jobs can access Lake Formation over the internet or via a VPC endpoint, but that is not the cause of the AccessDenied error.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The IAM role used by the Glue job does not have Lake Formation permissions.
Why this is correct
Correct. The IAM role must have Lake Formation permissions to access the table.
- ✗
The S3 bucket policy does not allow the Glue job to access the data.
Why it's wrong here
Incorrect. The S3 bucket policy is not the issue; Lake Formation permissions are required.
- ✗
The table has not been registered with Lake Formation.
Why it's wrong here
Incorrect. The table is already registered if it is a Lake Formation-managed table.
- ✗
The Glue job is not running in the same VPC as Lake Formation.
Why it's wrong here
Incorrect. Lake Formation does not require a specific VPC; the error is due to missing Lake Formation permissions.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DEA-C01 question is part of Courseiva's 1,711-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.