MLA-C01 Practice Question 82: Lake Formation Column Permissions
AWS Certified Machine Learning Engineer – Associate (MLA-C01) · Test 9 · question 2 of 10
A bank's data lake stores customer tables as Parquet files in Amazon S3, cataloged in the AWS Glue Data Catalog and governed by AWS Lake Formation. Data scientists query the customers table with Amazon Athena to build training datasets. Compliance says data scientists must be able to query every column except ssn and full_name, while the fraud investigations team keeps access to all columns. The bank does not want to maintain a second copy of the data.
How should the data engineer enforce this?
Show answer and explanation
Answer:
Lake Formation provides column-level security through data filtering. When you grant permissions on a Data Catalog table with column filtering, principals see only the columns they are allowed to see. Services that integrate with Lake Formation, such as Athena, enforce this at query time. The data scientists' role gets SELECT on every column except the two sensitive ones, the fraud team keeps full access, and there is still only one copy of the data (option A).
- B is wrong because it creates the second copy the bank wants to avoid, adds a pipeline to run, and leaves the copy up to a day stale. - C is wrong because S3 permissions apply to whole objects. A bucket policy cannot allow part of a Parquet file and deny another part, so it cannot hide individual columns. - D is wrong because Athena workgroups separate query settings, results locations, and cost controls. They are not a way to authorize access to particular columns.
Reference: Data filtering and cell-level security in Lake Formation