DEA-C01 practice question: Permissions with Lake Formation (2 of 3)
Data Security and Governance A free question from our original DEA-C01 practice exam. Try it, then open the answer to see why each option is right or wrong.
A telecom company's data lake has 400 Glue tables across 20 databases, and new tables are added every week. Columns that hold personal data, such as phone numbers and birth dates, appear in many of them. Data analysts may see only columns that are not tagged as personal.
Granting access table by table has not kept up with new tables, and the security team wants access rules that apply automatically to tables and columns added later.
Which approach meets these requirements?
Choose one answer.
AA. Tag the databases sensitivity=general, override the personal columns with sensitivity=personal, and grant analysts SELECT on the expression sensitivity=general.
BB. Create a Lake Formation grant for each table and each analyst group when a new table appears, using a runbook for the data team to follow.
CC. Make a masked copy of each table with the personal columns removed, and give analysts access to the copies in a separate database.
DD. Give the analysts an IAM policy that lists the names of the non-personal columns for each table, and update the policy each week.
Show the answer and explanation
Answer: A
A. Right: Correct. Tables and columns inherit LF-tags from their database, and a column can override the inherited value. A grant on sensitivity=general covers every matching column, including those in tables added later, while columns tagged personal stay hidden. Learn more: Lake Formation tag-based access control (opens in a new tab)
B. Wrong: Per-table grants depend on the runbook being followed for every new table, which is the process that has already fallen behind. The option does not apply rules automatically to new tables.
C. Wrong: Masked copies double the number of tables and need a copy process for every new table. The option adds the work the team wants to remove.
D. Wrong: IAM policies cannot evaluate column tags in Lake Formation, and a weekly update of column lists is manual maintenance. The option does not scale to 400 tables.
Explanation
LF-tags let the security team classify data once and grant access by tag expression. Tables and columns inherit the database's tag, personal columns override it, and the analysts' grant on the general value covers new tables automatically. Per-table grants, masked copies and IAM column lists each need manual upkeep for every new table.
Want more on Permissions with Lake Formation? The 5 full-length practice sets have 10 more Permissions with Lake Formation questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →