AWS Certified Data Engineer Associate DEA-C01 Practice Question

Your company stores raw transactional data with credit-card and SSN columns in an Amazon S3 data lake. Business analysts query the data using Amazon Athena. Compliance mandates that analysts see all columns except those with PII. The solution must avoid duplicating data, follow least privilege, and require minimal maintenance. Which approach satisfies these needs?

Encrypt PII columns client-side before uploading to S3 and withhold the encryption key from analysts so that ciphertext values appear unreadable when they query the data.
Use an AWS Glue job to copy the dataset into a new Parquet table that omits PII columns, and direct analysts to query the new table instead of the raw data.
Register the S3 location with AWS Lake Formation, tag PII columns in the Data Catalog, and grant the analyst group column-level permissions that exclude columns tagged as PII.
Schedule Amazon Macie to classify objects daily and move any files containing PII to an encrypted quarantine bucket that analysts cannot access; analysts query the remaining bucket with Athena.

Report Issue

Answer Description

AWS Lake Formation integrates with Amazon Athena and supports fine-grained permissions down to the column level. By registering the S3 location in Lake Formation, adding the tables to the AWS Glue Data Catalog, and using LF-Tags to identify PII columns, administrators can grant analysts SELECT access to the table while explicitly denying access to columns tagged as PII. Because the data stays in place and permissions are enforced at query time, no additional copies of the dataset or ongoing ETL jobs are required.

Running Amazon Macie and moving objects to a different bucket protects data but introduces daily jobs and creates multiple data copies. Encrypting PII client-side still exposes ciphertext to analysts, does not prevent access, and requires application changes. Creating a separate table without PII columns duplicates data and adds maintenance overhead. Therefore, using Lake Formation column-level security is the most efficient and compliant solution.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.