The correct combination is AWS Lake Formation for fine-grained access control and auditing, paired with Amazon S3 Object Lambda to mask data on the fly. Lake Formation enables column, row, and cell-level permissions on S3 data lakes, while its integration with AWS CloudTrail provides the required auditing of data access. S3 Object Lambda then intercepts each GET request to dynamically redact or mask sensitive fields before the data reaches unauthorized users, fulfilling the masking requirement without duplicating data. On the AWS Certified Solutions Architect Professional SAP-C02 exam, this scenario tests your ability to distinguish between native S3 policies (which are too coarse for cell-level control) and Lake Formation’s granular governance, plus your understanding that S3 Object Lambda handles real-time transformations like masking, whereas services like Macie only discover sensitive data. A common trap is choosing S3 bucket policies with IAM conditions, which cannot mask data or provide row-level security. Memory tip: think “Lake for locks, Lambda for masks.”
SAP-C02 Design for New Solutions Practice Question
This SAP-C02 practice question tests your understanding of design for new solutions. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company is designing a new data lake solution on AWS using Amazon S3 as the storage layer. The data lake will be used by multiple teams for analytics and machine learning. The company needs to enforce fine-grained access control at the object level, enable auditing of data access, and ensure that sensitive data is masked for unauthorized users. Which combination of AWS services should be used?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Lake Formation for fine-grained access control and auditing, and Amazon S3 Object Lambda to mask data on the fly.
Option D is correct because AWS Lake Formation provides fine-grained access control at the column, row, and cell level for data in S3, and it integrates with AWS CloudTrail for auditing data access. Amazon S3 Object Lambda can transform data on the fly, such as masking sensitive fields, before returning it to the requester, meeting the requirement to mask data for unauthorized users.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Use S3 bucket policies and S3 access logs for auditing.
Why it's wrong here
Bucket policies are not fine-grained enough for object-level control and do not mask data.
✗
Use Amazon Macie to discover sensitive data and apply S3 bucket policies to restrict access.
Why it's wrong here
Macie discovers sensitive data but does not mask it; it's for classification.
✗
Use IAM policies with condition keys and enable AWS CloudTrail for auditing.
Why it's wrong here
IAM policies control access but do not provide data masking at the object level.
✓
Use AWS Lake Formation for fine-grained access control and auditing, and Amazon S3 Object Lambda to mask data on the fly.
Why this is correct
Lake Formation provides row/column-level security and auditing; S3 Object Lambda can transform data for masking.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often assume IAM policies or S3 bucket policies alone can achieve fine-grained access control, but they lack the column/row-level granularity and dynamic data masking that Lake Formation and S3 Object Lambda provide.
Detailed technical explanation
How to think about this question
Lake Formation uses a grant/revoke model with a Data Catalog to manage permissions at the database, table, and column level, and it integrates with AWS Glue and Athena to enforce these policies at query time. S3 Object Lambda uses Lambda functions to intercept S3 GET requests, allowing dynamic transformation (e.g., redacting credit card numbers) based on the caller's IAM role or other context, without duplicating data. This combination is essential for regulated industries like healthcare or finance where row-level security and on-the-fly masking are required.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Design for New Solutions — This question tests Design for New Solutions — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Use AWS Lake Formation for fine-grained access control and auditing, and Amazon S3 Object Lambda to mask data on the fly. — Option D is correct because AWS Lake Formation provides fine-grained access control at the column, row, and cell level for data in S3, and it integrates with AWS CloudTrail for auditing data access. Amazon S3 Object Lambda can transform data on the fly, such as masking sensitive fields, before returning it to the requester, meeting the requirement to mask data for unauthorized users.
What should I do if I get this SAP-C02 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.