SAP-C02 Design for New Solutions Practice Question
A company is designing a new data lake on AWS. The data lake will store raw data in Amazon S3 and use Amazon Athena for ad-hoc queries. The company needs to ensure that only authorized users can query specific partitions based on their department. Which approach should the company use to implement fine-grained access control?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Lake Formation to define data filters and grant permissions to departments at the partition level.
Using AWS Lake Formation with data filters allows fine-grained access control at the partition level. Option B is incorrect because S3 bucket policies can restrict access to object prefixes but cannot control access at the partition level within Athena queries. Option C is incorrect because Redshift Spectrum is designed for querying data in Amazon Redshift, not Athena. Option D is incorrect because while separate IAM roles can provide access to specific databases or tables, they cannot easily restrict access to specific partitions in Athena without Lake Formation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use AWS Lake Formation to define data filters and grant permissions to departments at the partition level.
Why this is correct
Lake Formation provides fine-grained access control, including partition-level filtering for Athena.
- ✗
Use S3 bucket policies to restrict access to prefixes corresponding to each department.
Why it's wrong here
Bucket policies can restrict prefixes, but they are not integrated with Athena's partition metadata.
- ✗
Store each department's data in separate databases and use Amazon Redshift Spectrum to query.
Why it's wrong here
Redshift Spectrum is not the query engine; Athena is used for ad-hoc queries.
- ✗
Create separate IAM roles for each department and attach policies that grant access to specific partitions in Athena.
Why it's wrong here
Athena does not support partition-level IAM permissions natively; it queries all partitions unless filtered.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.