ExamPark
Course menuDEA-C01

Exams / DEA-C01 / Permissions with Lake Formation / Question 3

DEA-C01 practice question: Permissions with Lake Formation (3 of 3)

Data Security and Governance A free question from our original DEA-C01 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A grocery chain's producer account holds a shipments table in the Glue Data Catalog. A consumer account belongs to the regional managers' analytics team. Each regional manager may query only the rows for their own region, and the consumer account's analysts use Athena.

The producer's data team wants the rule enforced by Lake Formation, not by copying the data, and the regions must not be visible to each other.

Which TWO actions meet these requirements? (Choose two.)

Choose two answers.

  1. A. Copy the shipments table into the consumer account with a region filter in the copy job, and let the analysts query the copy.
  2. B. Give the consumer account an S3 bucket policy that allows read access to the shipments prefix, and let the analysts filter rows in their queries.
  3. C. Give every consumer analyst a copy of the producer's IAM role, so that the analysts can call the Glue API directly against the producer's catalog.
  4. D. Create a Lake Formation data filter on the shipments table that keeps only the rows for each region, and grant the filter to the consumer account's principals.
  5. E. Create a resource link in the consumer account that points to the shared shipments table, so that the consumer's database can grant access to the analysts.
Show the answer and explanation

Answers: D, E

  • A. Wrong: A copy duplicates the data and needs a job to keep it current, and the filter in the job is not enforced by Lake Formation. The option breaks the no-copy requirement.
  • B. Wrong: A bucket policy grants access to whole objects and cannot restrict rows. Analysts could see every region, which the producer does not allow.
  • C. Wrong: Sharing a role across accounts gives every analyst the producer's full access, which the regional rule forbids. The option grants far more than the regional rule allows.
  • D. Right: Correct. A data filter defines the rows a principal may see, and Lake Formation enforces it at query time in Athena. Granting the filter to the consumer account keeps the rule in the producer's control without copying data. Learn more: Data filters in Lake Formation (opens in a new tab)
  • E. Right: Correct. A resource link lets the consumer account reference a shared table in its own catalog, so the consumer's Lake Formation grants can reach the shared table. Combined with the data filter, the analysts see only their region's rows. Learn more: Cross-account data sharing in Lake Formation (opens in a new tab)

Explanation

Cross-account sharing in Lake Formation uses two parts. A data filter in the producer account limits the rows a consumer principal can see, which enforces the regional rule at query time. A resource link in the consumer account lets its Lake Formation grants reach the shared table, so no data is copied. Copies, bucket policies and shared roles each break the no-copy or regional-visibility requirement.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free DEA-C01 practice examPractice Permissions with Lake FormationAll Permissions with Lake Formation questions

Want more on Permissions with Lake Formation? The 5 full-length practice sets have 10 more Permissions with Lake Formation questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets