AWS Certified Data Engineer - Associate DEA-C01Demo

By Amazon · Question Mode

QuestionQ17

Data Security and Governance

A retail company keeps customer data in an Amazon S3 bucket. Some customer data includes personally identifiable information (PII) about customers. The company must not disclose PII data to business partners.

A data engineer needs to determine whether a dataset contains PII before making objects in that dataset available to business partners.

Which solution meets this requirement with the LEAST manual intervention?

  • A Configure the S3 bucket and S3 objects to allow access to Amazon Macie. Use automated sensitive data discovery in Macie.
  • B Configure AWS CloudTrail to monitor S3 PUT operations. Inspect the CloudTrail trails to identify operations that save PII.
  • C Create an AWS Lambda function to identify PII in S3 objects. Schedule the function to run periodically.
  • D Create a table in AWS Glue Data Catalog. Write custom SQL queries to identify PII in the table. Use Amazon Athena to run the queries.
Explanation

Amazon Macie automates sensitive-data discovery and classification for Amazon S3 objects. Its automated sensitive data discovery continually evaluates S3 bucket inventory, analyzes selected objects for sensitive data such as PII, and produces findings for objects containing sensitive data. This provides managed detection with less manual implementation and maintenance than custom Lambda code or Athena SQL queries; CloudTrail records S3 API activity but does not inspect object contents for PII.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!