SAP-C02 Design for New Solutions Practice Question
A company is building a data lake on Amazon S3 using Parquet files. The data will be queried by multiple teams using Amazon Athena. The security team requires that access to sensitive columns (e.g., PII) be restricted based on the user's role. Which solution provides column-level access control with the LEAST administrative overhead?
⚠ Common exam trap
Candidates often assume S3 bucket policies or IAM conditions can achieve column-level access, but these operate at the object or API level and cannot filter columns within a single file, which is a key distinction tested in the SAP-C02 exam.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Lake Formation to define column-level permissions in the Data Catalog.
AWS Lake Formation provides native column-level filtering in the Data Catalog, allowing you to define granular permissions on specific columns of a table without moving or duplicating data. When Athena queries a table registered with Lake Formation, the service automatically applies column-level access controls based on the IAM role or user, enforcing the restriction at query runtime with minimal administrative overhead.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use AWS Lake Formation to define column-level permissions in the Data Catalog.
Why this is correct
Lake Formation integrates with Athena and allows fine-grained column-level access control with minimal effort.
- ✗
Create separate S3 buckets for sensitive and non-sensitive data and apply bucket policies to restrict access.
Why it's wrong here
Bucket policies control access to objects, not columns within a file.
- ✗
Load the data into Amazon Redshift and use Redshift Spectrum to query S3, then apply column-level security through Redshift.
Why it's wrong here
Loading data into Amazon Redshift and using Redshift Spectrum introduces a separate compute engine and storage layer, adding administrative overhead for managing both the Redshift cluster and Spectrum external tables, whereas the stem requires a solution with least overhead for column-level access control on S3 Parquet files queried directly by Athena. This option is tempting because Redshift does support column-level security via views or row-level security policies, and Spectrum can query S3 data, making it a valid choice if the company already used Redshift as its primary analytics platform and needed fine-grained access across both Redshift and S3 datasets.
- ✗
Use IAM policies with condition keys to restrict access based on the Athena workgroup.
Why it's wrong here
IAM policies cannot restrict access to specific columns; they operate at the API level.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.