Question 1

A company uses Amazon Athena for one-time queries against data that is in Amazon S3. The company has

several use cases. The company must implement permission controls to separate query processes and access to

query history among users, teams, and applications that are in the same AWS account.

Which solution will meet these requirements?

Options :

A :

Create an S3 bucket for each use case. Create an S3 bucket policy that grants permissions to appropriate individual IAM users. Apply the S3 bucket policy to the S3 bucket.

B :

Create an Athena workgroup for each use case. Apply tags to the workgroup. Create an 1AM policy that uses the tags to apply appropriate permissions to the workgroup.

C :

Create an JAM role for each use case. Assign appropriate permissions to the role for each use case. Associate the role with Athena.

D :

Create an AWS Glue Data Catalog resource policy that grants permissions to appropriate individual IAM users for each use case. Apply the resource policy to the specific tables that Athena uses.

Answer: B

Question 2

A company has multiple applications that use datasets that are stored in an Amazon S3 bucket. The company

has an ecommerce application that generates a dataset that contains personally identifiable information (PII).

The company has an internal analytics application that does not require access to the PII.

To comply with regulations, the company must not share PII unnecessarily. A data engineer needs to

implement a solution that with redact PII dynamically, based on the needs of each application that accesses the

dataset.

Which solution will meet the requirements with the LEAST operational overhead?

Options :

A :

Create an S3 bucket policy to limit the access each application has. Create multiple copies of the dataset. Give each dataset copy the appropriate level of redaction for the needs of the application that accesses the copy.

B :

Create an S3 Object Lambda endpoint. Use the S3 Object Lambda endpoint to read data from the S3 bucket. Implement redaction logic within an S3 Object Lambda function to dynamically redact PII based on the needs of each application that accesses the data.

C :

Use AWS Glue to transform the data for each application. Create multiple copies of the dataset. Give each dataset copy the appropriate level of redaction for the needs of the application that accesses the copy.

D :

Create an API Gateway endpoint that has custom authorizers. Use the API Gateway endpoint to read data from the S3 bucket. Initiate a REST API call to dynamically redact PII based on the needs of each application that accesses the data.

Answer: B

Question 3

A company stores operational data in Amazon S3 using the S3 Standard storage class. Data usage analysis shows that most files are frequently accessed for the first 6 months, occasionally accessed for the next 18 months, and rarely accessed thereafter. The company seeks a cost-effective storage strategy that maintains high availability throughout the data lifecycle.

Which S3 Lifecycle policy should the company implement for their data storage needs?

Options :

A : Transition objects to S3 Standard-Infrequent Access (S3 Standard-IA) after 6 months, then to S3 Glacier after 2 years.

B : Transition objects to S3 One Zone-Infrequent Access (S3 One Zone-IA) after 6 months, then to S3 Glacier Deep Archive after 2 years.

C : Transition objects to S3 Standard-Infrequent Access (S3 Standard-IA) after 6 months, then to S3 Glacier Deep Archive after 2 years.

D : Transition objects to S3 Intelligent-Tiering after 6 months, then to S3 Glacier Deep Archive after 2 years.

Answer: C

Question 4

An organization is creating a data lake on AWS and requires granular access control. They need to grant specific users access to certain rows and columns within their datasets. The organization's teams will query the data using a combination of Amazon Athena, Amazon Redshift Spectrum, and Apache Hive on Amazon EMR.

Which AWS service should the organization implement to manage data permissions efficiently?

Options :

A : Use AWS Lake Formation to define fine-grained data access policies and facilitate queries through supported AWS services.

B : Manage access through S3 bucket policies and IAM roles for row and column-level security.

C : Deploy Apache Ranger on Amazon EMR for granular access control and utilize Amazon Redshift for querying.

D : Use Redshift security groups and views for row and column-level permissions, querying with Athena and Redshift Spectrum.

Answer: A

Question 5

An organization using Amazon Athena has multiple teams, each with different query execution requirements. The organization decides to enforce workgroup-wide settings in Athena to standardize query execution parameters and control costs.

What is an important consideration when enforcing workgroup-wide settings in Athena?

Options :

A : Workgroup-wide settings in Athena can only be applied to new queries, and existing queries will continue to use their original client-side settings.

B : Users can temporarily override workgroup-wide settings for individual queries if they have the necessary permissions.

C : Workgroup-wide settings in Athena are only applicable for cost controls and do not affect other query execution parameters.

D : Enforcing workgroup-wide settings means all queries in the workgroup will use these settings, overriding any individual client-side settings.

Answer: D