MLA-C01 · Question #42
An advertising company uses AWS Lake Formation to manage a data lake. The data lake contains structured data and unstructured data. The company's ML engineers are assigned to specific advertisement ca
The correct answer is C. Use Lake Formation to authorize AWS Glue to access the S3 bucket. Configure Lake Formation. Option C is correct because AWS Lake Formation is purpose-built as a unified access control layer for data lakes, letting you define permissions once and enforce them for both Athena queries (via the Glue Data Catalog) and direct S3 access. Using Lake Formation tag-based access c
Question
An advertising company uses AWS Lake Formation to manage a data lake. The data lake contains structured data and unstructured data. The company's ML engineers are assigned to specific advertisement campaigns. The ML engineers must interact with the data through Amazon Athena and by browsing the data directly in an Amazon S3 bucket. The ML engineers must have access to only the resources that are specific to their assigned advertisement campaigns. Which solution will meet these requirements in the MOST operationally efficient way?
Options
- AConfigure IAM policies on an AWS Glue Data Catalog to restrict access to Athena based on the
- BStore users and campaign information in an Amazon DynamoDB table. Configure DynamoDB
- CUse Lake Formation to authorize AWS Glue to access the S3 bucket. Configure Lake Formation
- DConfigure S3 bucket policies to restrict access to the S3 bucket based on the ML engineers'
How the community answered
(50 responses)- A16% (8)
- B6% (3)
- C74% (37)
- D4% (2)
Explanation
Option C is correct because AWS Lake Formation is purpose-built as a unified access control layer for data lakes, letting you define permissions once and enforce them for both Athena queries (via the Glue Data Catalog) and direct S3 access. Using Lake Formation tag-based access control (LF-tags), you can tag S3 resources by campaign and assign ML engineers accordingly - a single configuration covers both access paths with minimal ongoing maintenance.
Why the distractors fail:
- A - IAM policies on the Glue Data Catalog handle Athena access but do not govern direct S3 browsing, leaving a gap in the requirements.
- B - Storing campaign mappings in DynamoDB adds architectural complexity and custom logic; DynamoDB has no native integration with S3 or Athena access control, making this operationally expensive to maintain.
- D - S3 bucket policies can restrict direct S3 access, but they don't extend to Athena/Glue Catalog permissions, and managing granular per-engineer, per-campaign bucket policies at scale is operationally inefficient.
Memory tip: Think of Lake Formation as the single gatekeeper for the entire data lake - one control plane for both the "query door" (Athena via Glue) and the "storage door" (S3 directly). Whenever an exam scenario requires unified, campaign- or attribute-based access across multiple AWS data services, Lake Formation with LF-tags is almost always the operationally efficient answer.
Topics
Community Discussion
No community discussion yet for this question.