DEA-C01 Question 206
Single answerYou are working as a Data Engineer for a financial services company that needs to store and process sensitive customer data, including Personally Identifiable Information (PII) and financial transaction records. The data must comply with regulatory requirements like GDPR and PCI DSS. Which of the following is the most appropriate approach to classify and store this data in AWS?
- A
Classify the data as 'Public' and store it in an Amazon S3 bucket with public access enabled for faster retrieval.
- B
Classify the data as 'Confidential' and store it in an Amazon S3 bucket with server-side encryption enabled and fine-grained access controls using IAM policies.
- C
Classify the data as 'Internal' and store it in Amazon RDS without encryption as it is accessible only within the private VPC.
- D
Classify the data as 'Restricted' and store it in Amazon DynamoDB with DynamoDB Encryption at Rest enabled, while configuring IAM roles to enforce least privilege.
Show answer and explanation
Correct answer: B
Explanation
Sensitive data like PII and financial transaction records must be classified appropriately and stored in compliance with regulations such as GDPR and PCI DSS. Amazon S3 with server-side encryption and fine-grained access controls is a suitable choice for storing 'Confidential' data, as it provides scalability, security, and regulatory compliance.
- A. Incorrect.
Classifying sensitive data as 'Public' and enabling public access directly violates security best practices and compliance requirements like GDPR and PCI DSS.
- B. Correct.
Classifying the data as 'Confidential,' enabling server-side encryption in Amazon S3, and implementing fine-grained access controls meet the necessary security and compliance requirements for sensitive data like PII and financial records.
- C. Incorrect.
While classifying the data as 'Internal' and using Amazon RDS ensures that the data is within a private network, the lack of encryption does not meet compliance requirements for sensitive data.
- D. Incorrect.
Classifying the data as 'Restricted' and using DynamoDB with encryption is a good practice, but DynamoDB may not be the most suitable storage option for financial records and PII, which often require relational database capabilities or specific storage solutions like Amazon S3.