AIF-C01 Question 207
Select 3A data engineering team is designing a pipeline to process sensitive customer information such as Personally Identifiable Information (PII). Which of the following are best practices to ensure secure data engineering in this scenario?
- A
Encrypt sensitive data both in transit and at rest using AWS Key Management Service (KMS).
- B
Grant full administrative access to all team members to ensure smooth collaboration.
- C
Implement fine-grained access control using AWS Identity and Access Management (IAM) policies.
- D
Regularly assess and validate the quality of incoming data to prevent data corruption.
- E
Store unencrypted PII data in Amazon S3 for faster data retrieval.
Show answer and explanation
Correct answers: A, C, D
Explanation
To ensure secure data engineering, sensitive data must be encrypted both in transit and at rest, and access should be controlled through fine-grained IAM policies to minimize unauthorized access. Additionally, assessing data quality is essential for maintaining data integrity. Avoid practices like storing unencrypted sensitive data or granting excessive privileges, as they pose significant security risks.
- A. Correct.
Encryption is a critical best practice to ensure the confidentiality of sensitive data such as PII. AWS KMS can help manage encryption keys securely.
- B. Incorrect.
Granting full administrative access to all team members violates the principle of least privilege, increasing security risks.
- C. Correct.
Fine-grained access control through IAM policies ensures that only authorized users can access or modify sensitive data.
- D. Correct.
Assessing and validating data quality helps maintain data integrity and prevents issues caused by corrupted or invalid data.
- E. Incorrect.
Storing unencrypted PII data is not a secure practice and violates data privacy and compliance requirements.