AWS Lake Formation Row-Level Security for S3 Data Hub

DEA-C01 By islever Editorial Last updated Oct 9, 2026

Apply authorization mechanisms.

Short answer

B Register the S3 bucket in AWS Lake Formation and use row-level security to enforce country-based access policies with minimal operational effort.

Question

A retail company has a customer data hub in an Amazon S3 bucket. Employees from many countries use the data hub to support company-wide analytics. A governance team must ensure that the company's data analysts can access data only for customers who are within the same country as the analysts. Which solution will meet these requirements with the LEAST operational effort?

Create a separate table for each country's customer data. Provide access to each analyst based on the country that the analyst serves.
Register the S3 bucket as a data lake location in AWS Lake Formation. Use the Lake Formation row-level security features to enforce the company's access policies. Correct Answer
Move the data to AWS Regions that are close to the countries where the customers are. Provide access to each analyst based on the country that the analyst serves.
Load the data into Amazon Redshift. Create a view for each country. Create separate IAM roles for each country to provide access to data from each country. Assign the appropriate roles to the analysts.

Key Takeaways

Implementing row-level security via AWS Lake Formation tests the ability to apply fine-grained authorization with minimal operational overhead compared to re-architecting data or managing multiple IAM roles.

AWS Lake Formation provides native row-level security to restrict data access in an Amazon S3 data lake based on user attributes, such as country. This solution meets the requirement with the least operational effort by avoiding data restructuring or complex IAM role management.

Common mistake: Choosing A or D because they seem straightforward, but they require significant ongoing operational effort to maintain separate tables, views, and IAM roles for each country.

Expert Analysis

Why the Answer Is Correct

AWS Lake Formation allows you to register an existing Amazon S3 bucket as a data lake and apply fine-grained access controls, including row-level security. This natively enforces the policy that analysts only8see data from their own country without requiring data duplication, restructuring, or moving the data, thus meeting the requirement with the least operational effort.

Why the Other Options Are Wrong

Option A requires2requires restructuring the data into separate tables per country and managing access to each, which introduces significant operational overhead for schema changes and data updates.
Option C involves moving data across AWS Regions, incurring high data transfer costs and massive operational complexity.
Option D requires loading data into Amazon Redshift, creating views for every country, and managing separate IAM roles, which is far more operationally heavy than using Lake Formation.

Community Comment Notes

Some users questioned if setting up Lake Formation takes too much effort, with one noting "Creating DataLake takes at least few days1few days to set up". However, the consensus is that compared to manually restructuring tables or managing Redshift views and IAM roles, Lake Formation is the least operationally intensive, as "AWS really likes Lakeformation, plus creating separate tables might require some refactoring".

Exam Strategy

For "least operational effort" questions involving fine-grained access control over S3 data, always prefer AWS Lake Formation row-level or column-level security over manual data partitioning, Redshift views, or IAM role permutations.

Community Votes

100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 10 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 10

k350Secops 👍 12 Answered B

AWS Lake Formation: It's specifically designed for managing data lakes on AWS, providing capabilities for securing and controlling access to data. Row-Level Security: With Lake Formation, you can define fine-grained access control policies, including row-level security. This means you can enforce policies to restrict access to data based on specific conditions, such as the country associated with each customer. Least Operational Effort: Once the policies are defined within Lake Formation, they can be centrally managed and applied to the data in the S3 bucket without the need for creating separate tables or views for each country, as in options A, C, and D. This reduces operational overhead and complexity.
[Removed] 👍 3 Answered B

https://docs.aws.amazon.com/lake-formation/latest/dg/register-data-lake.html https://docs.aws.amazon.com/lake-formation/latest/dg/registration-role.html
BartoszGolebiowski24 👍 2

Creating DataLake takes at least few days to set up and the solution should be LEAST operational. I think B is not correct.
mattia_besharp 👍 1 Answered B

AWS really likes Lakeformation, plus creating separate tables might require some refactoring, and the requirements is about the LEAST operational effor
rishadhb 👍 1 Answered A

Agreed with Bartosz. I think setup DataLake, then integrate it with LakeFormation take a lot of effort than just separate the table

Show 5 more comments

gray2205 👍 1

if the situation is not about least operational effort, D makes sense
lunachi4 👍 1 Answered B

Select B. It means "with the LEAST operational effort".
GiorgioGss 👍 1 Answered B

Keyword "LEAST operational effort" - I will go with B
nanaw770 👍 2 Answered B

B is correct answer.
dried0extents 👍 1 Answered A

I agree that it is A

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All DEA-C01 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DEA-C01 Practice Test →

← Back to DEA-C01 Study Guide