DEA-C01 practice question: Permissions with Lake Formation (1 of 3)
Data Security and Governance A free question from our original DEA-C01 practice exam. Try it, then open the answer to see why each option is right or wrong.
A hospital group's data lake catalogs its encounter data in AWS Glue, and analysts query it with Amazon Athena. The table has 80 columns, and 12 of them hold patient identifiers and diagnosis codes. Analysts in the operations group must see only the other columns.
The table was created with the default Lake Formation settings, so anyone with an IAM policy for the Glue table can read every column. The data team wants Lake Formation to enforce the column restriction for Athena queries.
Which change meets these requirements?
Choose one answer.
AA. Add an IAM policy to the operations group that denies the Athena actions on the table, and grant the group access through a new bucket policy.
BB. Create a view in Athena that excludes the 12 sensitive columns, and tell the operations group to query the view instead of the table.
CC. Copy the table to a new S3 prefix without the 12 columns each night, and give the operations group access to the copy only.
DD. Revoke the Super permission from the IAMAllowedPrincipals group on the table, then grant the operations group SELECT on only the 68 permitted columns in Lake Formation.
Show the answer and explanation
Answer: D
A. Wrong: IAM policies on the table and the bucket do not restrict individual columns in Athena queries, and the default settings still let IAM grant full table access. The option cannot enforce a column-level rule.
B. Wrong: A view works as a workaround, but the analysts' IAM policy would still allow reading the base table. The option does not enforce the restriction on the table itself.
C. Wrong: The nightly copy is a separate data set that must be kept in sync and governed. The option does not use Lake Formation to enforce the restriction.
Lake Formation can restrict individual columns, but its default grant to IAMAllowedPrincipals makes IAM policies the only control. Revoking that Super grant on the table lets Lake Formation enforce the permissions, and column-level SELECT then limits what the operations group can see in Athena. Bucket policies, IAM denies, views and copies do not enforce the same rule.
Want more on Permissions with Lake Formation? The 5 full-length practice sets have 10 more Permissions with Lake Formation questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →