Amazon Web ServicesAssociate levelDEA-C01Page 6 of 6

DEA-C01 exam dumps: questions 501 to 549 of 549

Page 6 of the free DEA-C01 question bank for the AWS Certified Data Engineer - Associate exam. Questions 501 to 549 are listed below, the first 5 in full with answers and explanations. Back to page 1 for the exam overview and FAQ.

Question bank last updated December 2024

Start timed practice exam Questions 501 to 549

Free DEA-C01 practice questions

Questions 501 to 505 of 549

Pick an answer before you open the explanation. Each question also has its own page with a permalink.

DEA-C01 Question 501

Select 3

You are designing a data pipeline for a healthcare application that processes sensitive patient data. To comply with data privacy regulations, you need to anonymize personally identifiable information (PII), such as patient names and social security numbers, while ensuring that the data remains usable for analytics. Which of the following approaches would help achieve this requirement?

A
Use AWS Glue to apply data masking by substituting sensitive values with random characters.
B
Use AWS KMS to encrypt PII data and store the encryption keys within the data pipeline.
C
Apply key salting to hash sensitive data consistently while preventing reverse engineering.
D
Use Amazon Macie to automatically detect and delete all PII from the dataset.
E
Apply deterministic encryption to PII fields to allow repeatable anonymized values for analytics.

Show answer and explanation

Correct answers: A, C, E

Explanation

Anonymizing sensitive data while keeping it usable for analytics requires techniques like data masking, deterministic encryption, and key salting. These methods ensure compliance with privacy regulations while preserving the data's utility. AWS KMS encryption and Amazon Macie, though useful for data security and detection, do not directly fulfill the requirement of anonymization for analytical purposes.

A. Correct.
Using AWS Glue for data masking is a valid approach to anonymize data by replacing sensitive information with obfuscated values.
B. Incorrect.
While AWS KMS can encrypt data, simply encrypting the data without applying anonymization techniques does not meet the requirement of making the data usable for analytics.
C. Correct.
Key salting ensures that hashed sensitive data is protected from reverse engineering while maintaining consistency, making it a suitable approach for anonymization.
D. Incorrect.
Amazon Macie detects sensitive data but does not provide anonymization or masking capabilities. Deleting all PII would prevent the data from being usable for analytics.
E. Correct.
Deterministic encryption produces consistent outputs for the same input, allowing anonymized values to be used for analytics while protecting sensitive information.

DEA-C01 Question 502

Select 2

Your organization needs to share a dataset containing customer information with a third-party analytics service. To comply with privacy regulations, customer names and email addresses must be anonymized. The solution should also ensure that anonymized data is resistant to re-identification attacks. Which combination of approaches should you use to achieve this goal?

A
Use deterministic encryption with a shared key to mask customer names and email addresses.
B
Apply data masking techniques and add random key salting for anonymized fields.
C
Use hashing algorithms with a salt to anonymize customer names and email addresses.
D
Perform format-preserving encryption on sensitive fields to ensure compatibility with the analytics service.
E
Replace customer names and email addresses with random pseudonyms without using a key or salt.

Show answer and explanation

Correct answers: B, C

Explanation

To anonymize sensitive data such as customer names and email addresses while ensuring resistance to re-identification, you should use hashing with a salt or masking techniques combined with key salting. These approaches introduce randomness and prevent predictable patterns, making it computationally difficult to reverse-engineer or identify individuals from the anonymized dataset.

A. Incorrect.
Deterministic encryption with a shared key could still allow patterns to be identified, making the data vulnerable to re-identification. This approach does not satisfy the goal of strong anonymization.
B. Correct.
Data masking combined with key salting ensures that anonymized data is resistant to re-identification attacks, as the salt introduces randomness and prevents predictable patterns.
C. Correct.
Hashing algorithms with a salt provide a strong anonymization mechanism by making it computationally infeasible to reverse-engineer the original data. This approach is resistant to re-identification attacks.
D. Incorrect.
Format-preserving encryption does not anonymize the data but rather encrypts it while maintaining its format. This does not meet the requirement for anonymization.
E. Incorrect.
Replacing sensitive fields with random pseudonyms without using a key or salt may lead to incomplete anonymization, as the process lacks cryptographic guarantees and could lead to re-identification under certain circumstances.

DEA-C01 Question 503

Select 3

You are designing a data pipeline for a healthcare application that processes sensitive patient data. The processed data must be anonymized to protect patient identities before being stored in Amazon S3 for analytics purposes. You decide to use a combination of data masking and key salting to achieve anonymization. Which of the following actions are essential for securely implementing this solution?

A
Use a consistent salt value for all records to ensure data can be re-identified if needed.
B
Store the salt values in a secure location, such as AWS Secrets Manager or AWS Systems Manager Parameter Store.
C
Apply cryptographic hashing (e.g., SHA-256) to sensitive fields after appending the salt.
D
Mask sensitive fields, such as Social Security Numbers (SSNs), by replacing parts of the data with generic characters.
E
Store the unhashed, salted sensitive data in a separate S3 bucket for future reference.

Show answer and explanation

Correct answers: B, C, D

Explanation

When implementing data anonymization, techniques like masking and key salting must be applied securely. Salting ensures unique hashes by appending random values to sensitive fields before hashing, preventing predictable patterns. Storing the salt securely in AWS Secrets Manager or Parameter Store protects the anonymization process. Additionally, masking reduces exposure risks by obscuring sensitive portions of the data. Missteps, such as using a consistent salt value or storing unhashed sensitive data, compromise the security and compliance of the pipeline.

A. Incorrect.
Using a consistent salt value across all records undermines the purpose of salting because it makes hashed values predictable, enabling attackers to perform dictionary attacks.
B. Correct.
Storing the salt values securely is essential for ensuring the integrity of the anonymization process. AWS Secrets Manager or AWS Systems Manager Parameter Store provides secure storage and access control for sensitive information.
C. Correct.
Cryptographic hashing with a salt ensures that sensitive fields are anonymized and that the resulting values are unique and non-reversible. This is a critical step in data anonymization.
D. Correct.
Masking sensitive fields by replacing parts of the data with generic characters (e.g., 'XXX-XX-1234' for SSNs) is an effective technique for data masking and helps protect sensitive information.
E. Incorrect.
Storing unhashed, salted sensitive data in S3 undermines the anonymization process because it enables re-identification of the original data, violating security and compliance requirements.

DEA-C01 Question 504

Select 2

A healthcare company is building a data lake on Amazon S3 to store sensitive customer data, including personally identifiable information (PII). To ensure compliance with data privacy regulations, they need to anonymize the data before analysis. They also want to prevent unauthorized users from reversing the anonymization process. Which combination of approaches should the company use to meet these requirements?

A
Use AWS Glue to hash PII fields with a cryptographic hash function such as SHA-256 and incorporate a salt for added security.
B
Use Amazon Macie to mask sensitive data in real-time as it is uploaded to the S3 bucket.
C
Replace PII fields with randomly generated tokens using Amazon DynamoDB and store the mapping table in an encrypted DynamoDB table.
D
Encrypt PII fields using AWS Key Management Service (KMS) and allow authorized users to decrypt the data for analysis.
E
Apply S3 Object Lock to the data to prevent unauthorized access and modifications.

Show answer and explanation

Correct answers: A, C

Explanation

To comply with data privacy regulations, the company must anonymize data to ensure that even if unauthorized access occurs, the original PII cannot be reconstructed. Hashing with cryptographic functions and salting ensures strong, irreversible anonymization. Tokenization with secure storage of the mapping table also provides a robust anonymization strategy while maintaining usability for authorized processes. Other options, such as encryption and S3 Object Lock, do not fulfill the specific requirement to anonymize the data, and Amazon Macie is not designed for real-time anonymization.

A. Correct.
This is a correct option. Hashing PII fields with a cryptographic hash function and adding a salt makes it computationally infeasible for unauthorized users to reverse-engineer the original data.
B. Incorrect.
Amazon Macie is a data discovery and classification service and does not perform real-time data masking or anonymization.
C. Correct.
This is a correct option. Tokenization replaces sensitive data with tokens that can't be reversed without access to the mapping table, which can be stored securely in an encrypted DynamoDB table.
D. Incorrect.
Encryption protects data but does not anonymize it. Authorized users could still access the original PII, which does not meet the requirement for anonymization.
E. Incorrect.
S3 Object Lock prevents modification or deletion of objects but does not anonymize or mask data.

DEA-C01 Question 505

Select 2

You are a data engineer for a financial organization that must comply with strict regulatory requirements for audit logging. The security team has asked you to ensure that all application logs are securely stored, immutable, and can be easily retrieved for audits. Which combination of AWS services and features should you use to meet these requirements?

A
Store logs in Amazon S3 with S3 Object Lock enabled in Compliance mode.
B
Enable CloudTrail and configure it to deliver logs to an S3 bucket with versioning enabled.
C
Use Amazon CloudWatch Logs with log retention policies set to 'Never Expire'.
D
Enable AWS Config to track changes and deliver configuration snapshots to an S3 bucket.
E
Set up AWS Lambda to process and encrypt logs before storing them in Amazon RDS.

Show answer and explanation

Correct answers: A, B

Explanation

To prepare logs for audits, it is crucial to ensure their immutability, security, and retrievability. Using Amazon S3 with S3 Object Lock in Compliance mode guarantees logs cannot be altered or deleted. Additionally, CloudTrail captures detailed AWS activity logs and delivers them to S3, where versioning ensures logs are preserved. These features together provide a robust solution to meet audit and compliance requirements.

A. Correct.
Correct: S3 Object Lock in Compliance mode ensures that logs are immutable and cannot be deleted or altered, meeting audit requirements.
B. Correct.
Correct: CloudTrail provides detailed logging of AWS API calls and can deliver logs to S3 buckets for long-term storage. Enabling versioning ensures logs are preserved even if overwritten.
C. Incorrect.
Incorrect: While CloudWatch Logs supports log retention, it does not ensure immutability, which is a key compliance requirement for audits.
D. Incorrect.
Incorrect: AWS Config tracks resource configurations but does not serve as a solution for application log storage and immutability.
E. Incorrect.
Incorrect: While encrypting logs with Lambda is possible, storing them in Amazon RDS is not ideal for long-term, immutable, and cost-effective storage.

Timed practice exam

Take a DEA-C01 practice test under exam conditions

65 questions in 130 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

DEA-C01 practice questions 501 to 549 of 549

Every question has a page with the answer and explanation. Numbers are stable, so you can bookmark or share them. The bank is split into 6 pages of up to 100 questions.

More AWS exam dumps

All AWS exams

AIF-C01230 questions

AWS Certified AI Practitioner exam dumps

AWS Certified AI Practitioner

ANS-C01512 questions

AWS Advanced Networking Specialty exam dumps

AWS Certified Advanced Networking - Specialty

CLF-C02341 questions

AWS Certified Cloud Practitioner exam dumps

AWS Certified Cloud Practitioner

DOP-C02410 questions

AWS DevOps Engineer Professional exam dumps

AWS Certified DevOps Engineer - Professional

DVA-C02398 questions

AWS Developer Associate exam dumps

AWS Certified Developer - Associate

MLS-C01388 questions

AWS Machine Learning Specialty exam dumps

AWS Certified Machine Learning - Specialty

MLA-C01457 questions

AWS Machine Learning Engineer Associate exam dumps

AWS Certified Machine Learning Engineer - Associate

SCS-C02503 questions

AWS Security Specialty exam dumps

AWS Certified Security - Specialty