AWS DEA-C01: Data Store Management Practice Questions

Lake Formation natively supports column-level permissions on Glue Data Catalog tables, allowing administrators to grant SELECT on specific columns. Additionally, Lake Formation's permissions mode (as opposed to 'IAM-only' mode) enforces a default-deny posture so that new principals have no access unless explicitly granted via Lake Formation. — S3 bucket policies operate at the object/prefix level and cannot restrict access to individual columns within a file. Amazon Macie is a data classification and discovery service; it does not enforce access control. Glue crawlers populate catalog metadata but do not redact or restrict column access.

A lifecycle rule transitioning objects to S3 Glacier Flexible Retrieval after 180 days provides very low storage cost for rarely accessed compliance data, and an expiration action at 1,095 days (3 years) automatically deletes objects without manual intervention. This directly matches the stated access pattern and retention requirement. — S3 Intelligent-Tiering automatically moves objects between access tiers based on observed access patterns and is excellent for unpredictable access, but objects that are known to be rarely accessed after six months are better served by a predictable Glacier transition rule, which is cheaper than Intelligent-Tiering's per-object monitoring fee. One Zone-IA + Glacier Deep Archive adds an extra transition step; One Zone-IA offers lower redundancy (single AZ) which may not be acceptable for compliance data, and Deep Archive has longer retrieval times (up to 12 hours). Manual movement via CLI introduces operational overhead and human error risk, violating the 'minimal operational overhead' requirement.

A strongly consistent read in DynamoDB consumes 1 RCU per 4 KB (or fraction thereof). A 6 KB item requires ceil(6/4) = 2 RCUs for a strongly consistent read. — 1 RCU would cover a strongly consistent read of up to 4 KB; 6 KB exceeds this threshold. 3 RCUs would be needed if the item were between 8 KB and 12 KB. 6 RCUs would represent either 6 separate 4 KB reads or an incorrectly applied formula; DynamoDB rounds up to the nearest 4 KB boundary, not the nearest 1 KB.

A GSI with temperature as the partition key and timestamp as the sort key allows queries to target items with a specific temperature range (using Query with a KeyConditionExpression on the GSI) without scanning the entire table. This avoids the O(n) cost of a full table scan. — A Scan with FilterExpression reads every item in the table and then discards non-matching rows; it is highly inefficient for large tables. An LSI shares the same partition key as the base table (device_id), so it only enables range queries within a single device's partition and cannot query across all devices. The Streams + Lambda approach is an event-driven pattern useful for real-time replication but adds operational complexity and latency; it doesn't provide an efficient query interface for ad-hoc reporting.

By default, when a Glue crawler detects new columns added to an existing table, it updates the existing table definition in the Data Catalog to include those new columns. This is the 'Update the table definition in the Data Catalog' behavior for schema additions. — The crawler does not create a separate new table for schema changes; that would fragment metadata. The crawler does not silently ignore schema changes by default; it has configurable update and delete behaviors, but the default for added columns is to update. The crawler does not drop and recreate tables, which would lose permissions and cause downstream breakage.