DEA-C01 · Question #88
A company stores data in a data lake that is in Amazon S3. Some data that the company stores in the data lake contains personally identifiable information (PII). Multiple user groups need to access th
The correct answer is A. Use Amazon Athena to query the data. Set up AWS Lake Formation and create data filters to. AWS Lake Formation provides fine-grained access control directly over S3-backed data cataloged in AWS Glue, including column-level and row-level security. Data filters let you define exactly which columns and rows each user or group can see when querying via Athena or other integ
Question
A company stores data in a data lake that is in Amazon S3. Some data that the company stores in the data lake contains personally identifiable information (PII). Multiple user groups need to access the raw data. The company must ensure that user groups can access only the PII that they require. Which solution will meet these requirements with the LEAST effort?
Options
- AUse Amazon Athena to query the data. Set up AWS Lake Formation and create data filters to
- BUse Amazon QuickSight to access the data. Use column-level security features in QuickSight to
- CBuild a custom query builder UI that will run Athena queries in the background to access the data.
- DCreate IAM roles that have different levels of granular access. Assign the IAM roles to IAM user
How the community answered
(27 responses)- A70% (19)
- B4% (1)
- C7% (2)
- D19% (5)
Explanation
AWS Lake Formation provides fine-grained access control directly over S3-backed data cataloged in AWS Glue, including column-level and row-level security. Data filters let you define exactly which columns and rows each user or group can see when querying via Athena or other integrated services - without duplicating or transforming data. Option B (QuickSight column-level security) only restricts access within QuickSight dashboards; users who access raw S3 or Athena directly are not protected. Option C (custom query builder) imposes high operational burden and is a fragile custom solution. Option D (IAM roles) can control bucket/prefix access but cannot natively enforce column-level filtering on structured data.
Topics
Community Discussion
No community discussion yet for this question.