Q68 — AWS SAA-C03 Ch.17

Question 68 of 89 | ← Chapter 17

Q1368. A company is building a data analysis platform on AWS by using AWS Lake Formation. The platform will ingest data from different sources such as Amazon S3 and Amazon RDS. The company needs a secure solution to prevent access to portions of the data that contain sensitive information.Which solution will meet these requirements with the LEAST operational overhead?

Correct Answer: B. Create data filters to implement row-level security and cell-level security.

Explanation

The correct answer is B. Create data filters to implement row-level security and cell-level security.Explanation:The company needs a secure and low-overhead solution to restrict access to sensitive data in AWS Lake Formation, which integrates with Amazon S3 (data lake storage) and Amazon RDS (relational data sources).Why Option B is the Best Choice:Native Lake Formation Security FeaturesLake Formation supports row-level security (RLS) and cell-level security (CLS) via data filters (also called fine-grained access controls).These filters allow defining which rows or cells a user or role can see based on attribute-based access control (ABAC) policies.No need for custom code (unlike Lambda-based solutions) Minimal operational overhead.Centralized Policy ManagementSecurity policies are defined in Lake Formation and enforced when users query data via Amazon Athena, Amazon Redshift Spectrum, or AWS Glue.No need to modify data sources (S3/RDS) or maintain separate cleanup processes.Real-Time EnforcementFilters are applied at query time, ensuring sensitive data is never exposed, even if access patterns change.Why Other Options Are Incorrect:A. Create an IAM role with permissions to access Lake Formation tables Too broad IAM roles control table-level access, not row/cell-level restrictions.Does not prevent access to sensitive data within tables.C. Create an AWS Lambda function that removes sensitive info before Lake Formation ingests it High operational overhead Requires:Pre-processing all data before ingestion.Maintaining the Lambda function.Handling schema changes if sensitive fields evolve.Data is permanently altered If sensitive data is needed later, it's lost. D. Create an AWS Lambda function that periodically queries and removes sensitive info from Lake Formation tablesEven worse overhead Requires:Continuous scanning of tables.Potential race conditions (data could be exposed between scans).Complexity in ensuring all sensitive data is caught.Best Practice for Sensitive Data in Lake Formation:Use Lake Formation data filters (RLS/CLS) to dynamically mask or block sensitive data. Define granular policies based on user attributes (e.g., department, job role). Enforce via Lake Formation permissions (not just IAM roles). Avoid modifying raw data (keep it intact for compliance/auditing).Conclusion:Option B is the most efficient and secure solution because it:Uses native Lake Formation security (no custom code).Provides fine-grained access control (row/cell-level).Requires minimal maintenance (policies are managed centrally).Avoid Options A, C, and D (they either lack granularity or introduce unnecessary complexity).Final Answer: B