Exam AWS Certified Data Analytics - Specialty topic 1 question 138 discussion

Exam question from Amazon's AWS Certified Data Analytics - Specialty

Question #: 138
Topic #: 1

[All AWS Certified Data Analytics - Specialty Questions]

A retail company is using an Amazon S3 bucket to host an ecommerce data lake. The company is using AWS Lake Formation to manage the data lake.
A data analytics specialist must provide access to a new business analyst team. The team will use Amazon Athena from the AWS Management Console to query data from existing web_sales and customer tables in the ecommerce database. The team needs read-only access and the ability to uniquely identify customers by using first and last names. However, the team must not be able to see any other personally identifiable data. The table structure is as follows:

Which combination of steps should the data analytics specialist take to provide the required permission by using the principle of least privilege? (Choose three.)

A. In AWS Lake Formation, grant the business_analyst group SELECT and ALTER permissions for the web_sales table.
B. In AWS Lake Formation, grant the business_analyst group the SELECT permission for the web_sales table.
C. In AWS Lake Formation, grant the business_analyst group the SELECT permission for the customer table. Under columns, choose filter type ג€Include columnsג€ with columns fisrt_name, last_name, and customer_id.
D. In AWS Lake Formation, grant the business_analyst group SELECT and ALTER permissions for the customer table. Under columns, choose filter type ג€Include columnsג€ with columns fisrt_name and last_name.
E. Create users under a business_analyst IAM group. Create a policy that allows the lakeformation:GetDataAccess action, the athena:* action, and the glue:Get* action.
F. Create users under a business_analyst IAM group. Create a policy that allows the lakeformation:GetDataAccess action, the athena:* action, and the glue:Get* action. In addition, allow the s3:GetObject action, the s3:PutObject action, and the s3:GetBucketLocation action for the Athena query results S3 bucket.

Show Suggested Answer

Suggested Answer: BCF 🗳️

by CHRIS12722222 at April 23, 2022, 11:22 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

Ramshizzle

Highly Voted 2 years, 10 months ago

Selected Answer: BCF

It should be BCF. Athena always publishes the results of queries in a S3 bucket different from the source-bucket. To access the results you need permissions to this bucket. https://docs.aws.amazon.com/athena/latest/ug/querying.html Quote: To access and view query output files, IAM principals (users and roles) need permission to the Amazon S3 GetObject action for the query result location, as well as permission for the Athena GetQueryResults action

upvoted 8 times

...

alfredofmt

Highly Voted 2 years, 8 months ago

Selected Answer: BCF

A - WRONG, ALTER grants write access to raw data. B - CORRECT, SELECT grants read access to the transaction data, where no customer information is present. C - CORRECT, Lake Formation allows specifying which columns are accessible. customer_id is needed in order to join with web_sales table. D - WRONG, ALTER grants write access to raw data. E - WRONG, s3:GetObject is needed to see Athena results ( https://docs.aws.amazon.com/athena/latest/ug/querying.html ). F - CORRECT, even though it's Athena that puts the objects in the bucket and not the IAM user itself, granting s3:PutObject on the Athena bucket doesn't provide for the original S3 bucket where raw data resides.

upvoted 7 times

...