Q25 — AWS SAA-C03 Ch.11

Question 25 of 100 | ← Chapter 11

Q725. A company is building a data analysis platform on AWS by using AWS Lake Formation. The platform will ingest data from different sources such as Amazon S3 and Amazon RDS. The company needs a secure solution to prevent access to portions of the data that contain sensitive information.Which solution will meet these requirements with the LEAST operational overhead?

• A. Create an IAM role that includes permissions to access Lake Formation tables.
• B. Create data filters to implement row-level security and cell-level security. ✓
• C. Create an AWS Lambda function that removes sensitive information before Lake Formation ingests the data.
• D. Create an AWS Lambda function that periodically queries and removes sensitive information from Lake Formation tables.

Correct Answer: B. Create data filters to implement row-level security and cell-level security.

Explanation

To meet the requirement of preventing access to portions of the data that contain sensitive information with the least operational overhead, the most suitable solution is:B. Create data filters to implement row-level security and cell-level security.Option B, creating data filters to implement row-level security and cell-level security, is the recommended solution to prevent access to sensitive information with minimal operational overhead:- Data filters: In AWS Lake Formation, you can create data filters to implement fine-grained access controls at the row and cell levels. Data filters allow you to define conditions that restrict access to specific rows or cells based on the values in the data.By utilizing data filters, you can enforce access controls to prevent unauthorized access to portions of the data that contain sensitive information. This approach allows you to define and manage access controls directly within AWS Lake Formation, without the need for additional infrastructure or data processing steps.Option A, creating an IAM role that includes permissions to access Lake Formation tables, does not provide the granularity needed to prevent access to specific portions of the data. IAM roles control access at a higher level, such as table-level or database-level permissions, rather than row or cell-level permissions.Option C, creating an AWS Lambda function that removes sensitive information before Lake Formation ingests the data, introduces additional complexity and operational overhead. It requires developing and maintaining a custom Lambda function to preprocess the data and remove sensitive information. This approach may also introduce latency and potential data integrity issues.Option D, creating an AWS Lambda function that periodically queries and removes sensitive information from Lake Formation tables, is not an efficient solution. It requires continuous monitoring and processing of the data to identify and remove sensitive information. It also introduces additional complexity and potential performance impact.Therefore, the solution that meets the requirements with the least operational overhead is B: Create data filters to implement row-level security and cell-level security. This solution allows you to define fine-grained access controls directly within AWS Lake Formation, ensuring that only authorized users can access the sensitive portions of the data.