AIF-C01 Question 209
Select 3A data engineering team is building a pipeline to process sensitive customer data in AWS. The team wants to ensure secure data engineering by protecting data privacy, maintaining data integrity, and controlling access. Which of the following practices should they implement?
- A
Use AWS Key Management Service (KMS) to encrypt sensitive data at rest and in transit.
- B
Grant full administrative access to all users to simplify data access.
- C
Implement AWS Lake Formation to define fine-grained access control policies for data stored in Amazon S3.
- D
Use Amazon Macie to identify and protect sensitive data like personally identifiable information (PII).
- E
Disable logging to avoid unnecessary storage of access logs.
Show answer and explanation
Correct answers: A, C, D
Explanation
To achieve secure data engineering, it is essential to implement encryption (AWS KMS) to protect data at rest and in transit, use fine-grained access controls (AWS Lake Formation) to restrict unauthorized access, and leverage tools like Amazon Macie to identify and secure sensitive data. These practices align with best practices for data privacy, integrity, and access control. Avoid actions that compromise visibility or provide excessive access, such as disabling logging or granting full administrative permissions.
- A. Correct.
This is correct. AWS Key Management Service (KMS) provides encryption capabilities to protect sensitive data both at rest and in transit, which is a critical component of secure data engineering.
- B. Incorrect.
This is incorrect. Granting full administrative access to all users violates the principle of least privilege and increases the risk of unauthorized access.
- C. Correct.
This is correct. AWS Lake Formation supports fine-grained access controls, ensuring only authorized users and roles can access specific data, enhancing security and compliance.
- D. Correct.
This is correct. Amazon Macie is a data security service designed to identify, classify, and protect sensitive data, like PII, which is essential for protecting data privacy.
- E. Incorrect.
This is incorrect. Disabling logging undermines security by removing the ability to monitor access and detect unauthorized activities.