Which approach best implements column-level security in a data lakehouse?

Column-level security is enforced through governance frameworks (like Apache Ranger or IBM's governance layer) that apply column masking and row-filter policies at query time; without requiring data duplication. The incorrect options ("Storing sensitive columns in a separate S3 bucket with restricted IAM policies", "Converting sensitive columns to ORC format which supports built-in encryption", "Deleting sensitive columns from the Bronze layer before ingestion") are distractors that don't fully capture the concept described.