Regional analysts must only see rows for THEIR region in a shared sales table, and never see the salary column. Which Lake Formation capability enforces this?
A.Table-level grants only
Table grants are all-or-nothing per table.
B.Row-level and cell-level (column) security via data filters
Row filters + column restrictions = fine-grained access. Correct.
C.IAM policies on the S3 prefix
IAM on S3 can't express row-level conditions.
D.Athena workgroup query limits
Workgroups limit resources, not data visibility.
Why this answer
Lake Formation data filters implement row-level security (filter expressions like region='US') and cell-level security (column masking/exclusion) — granular access beyond table/column grants. This is the fine-grained governance differentiator.
Correct answer: B · Last reviewed 2026-11-05
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Data Governance practice session.
Practice Data Governance