DAS-C01 · Question #172
A retail company is using an Amazon S3 bucket to host an ecommerce data lake. The company is using AWS Lake Formation to manage the data lake. A data analytics specialist must provide access to a…
The correct answer is B. In AWS Lake Formation, grant the business_analyst group the SELECT permission for the web_sales C. In AWS Lake Formation, grant the business_analyst group the SELECT permission for the customer F. Create users under a business_analyst IAM group. Create a policy that allows the. Applying the principle of least privilege requires three steps: (B) Grant the business_analyst group the SELECT permission (not ALTER) on the web_sales table in Lake Formation - read-only access with no modification rights. (C) Grant the business_analyst group the SELECT…
Question
A retail company is using an Amazon S3 bucket to host an ecommerce data lake. The company is using AWS Lake Formation to manage the data lake. A data analytics specialist must provide access to a new business analyst team. The team will use Amazon Athena from the AWS Management Console to query data from existing web_sales and customer tables in the ecommerce database. The team needs read-only access and the ability to uniquely identify customers by using first and last names. However, the team must not be able to see any other personally identifiable data. The table structure is as follows:
Which combination of steps should the data analytics specialist take to provide the required permission by using the principle of least privilege? (Choose three.)
Exhibit
Options
- AIn AWS Lake Formation, grant the business_analyst group SELECT and ALTER permissions for the
- BIn AWS Lake Formation, grant the business_analyst group the SELECT permission for the web_sales
- CIn AWS Lake Formation, grant the business_analyst group the SELECT permission for the customer
- DIn AWS Lake Formation, grant the business_analyst group SELECT and ALTER permissions for the
- ECreate users under a business_analyst IAM group. Create a policy that allows the
- FCreate users under a business_analyst IAM group. Create a policy that allows the
How the community answered
(40 responses)- A13% (5)
- B80% (32)
- D3% (1)
- E5% (2)
Explanation
Applying the principle of least privilege requires three steps: (B) Grant the business_analyst group the SELECT permission (not ALTER) on the web_sales table in Lake Formation - read-only access with no modification rights. (C) Grant the business_analyst group the SELECT permission on the customer table but restrict it to only the first name and last name columns using Lake Formation's column-level permissions - this satisfies the requirement to identify customers without exposing other PII columns. (F) Create IAM users under a business_analyst IAM group with a policy that grants the necessary Athena and Glue read permissions required to use Athena from the AWS Management Console - Lake Formation governs data-level permissions while IAM governs service-level access. Options A and D are incorrect because they include ALTER permission, violating the read-only requirement. Option E likely grants broader permissions than necessary or uses the wrong IAM policy structure.
Topics
Community Discussion
No community discussion yet for this question.