Row level security limits which rows a user can access and column level security restricts access to individual columns within those rows is correct.

Row level security works by limiting which records a user can see or query. It is implemented with policies or predicates that filter rows at query time or at the storage layer so users only retrieve the subset of data they are authorized to view.

Column level security controls access to specific fields inside those rows. It is used to hide or restrict sensitive attributes so a user may see a record but not the protected columns within that record. This is enforced with column access controls, views, or masking features depending on the database.

Row level security is enforced only by the database engine while column level security must be applied in the client application is wrong because both row and column restrictions can be enforced by the database engine or by layered controls such as views and middleware. Client side enforcement is not a requirement for column level security.

Row level security is intended for structured tables while column level security is meant for unstructured data stores is wrong because both concepts apply to structured data models where rows and columns exist. Column level controls do not target unstructured stores, and unstructured systems use different access patterns.

Row level security commonly uses predicates to filter records and column level security often uses masking or column policies to hide field values is misleading and therefore not the best choice. Row filtering often uses predicates but that is an implementation detail rather than the defining difference. Masking is one technique for protecting columns but column level security more broadly includes access grants, policy tags, and view-based controls. The primary difference remains whether access is limited by rows or by columns.

Full AWS Practitioner Certification Question