Analysts should query a data lake table but must not see the salary column. Which Lake Formation capability enforces this — and why is a table-level deny insufficient?
A.Column-level permissions — exclude the salary column; a table-level deny blocks the whole table
Correct. Column-level grants are the designed mechanism.
B.Row-level filters on salary
Row filters restrict rows, not columns.
C.An S3 bucket policy denying the column
S3 policies don't understand table columns.
D.Encrypt the salary column with a different KMS key managed outside Lake Formation
Separate KMS keys work but is brittle — Lake Formation's designed answer is column-level grants.
Why this answer
Lake Formation supports column-level access control — analysts get the table minus excluded columns. Bucket policies operate at object level (can't see schema), and a table-level deny is all-or-nothing.
Correct answer: A · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Data Governance practice session.
Practice Data Governance