DEA-C01 Question 209
Select 3You are working as a data engineer for a financial institution that handles sensitive customer data, including Personally Identifiable Information (PII) and transactional data. The institution wants to use Amazon S3 to store this data and needs to classify it based on organizational compliance requirements. Which approach should you take to classify the data and ensure compliance?
- A
Use Amazon Macie to automatically discover and classify sensitive data, such as PII, in Amazon S3 buckets.
- B
Manually tag each S3 object with metadata to indicate its classification level.
- C
Leverage AWS Glue Data Catalog to assign data classifications using table and column metadata.
- D
Encrypt the data at rest with AWS Key Management Service (KMS) and consider it classified.
- E
Implement AWS Config rules to monitor S3 bucket policies and ensure compliance with data classification standards.
Show answer and explanation
Correct answers: A, C, E
Explanation
Classifying data based on compliance requirements involves leveraging automated tools and metadata management solutions. Amazon Macie is ideal for discovering sensitive data like PII automatically, while AWS Glue Data Catalog enables structured classification using metadata. AWS Config helps ensure compliance by monitoring bucket policies and enforcing standards. Manual tagging and encryption, while useful for specific scenarios, do not directly address the classification requirement comprehensively.
- A. Correct.
Amazon Macie uses machine learning to automatically discover and classify sensitive data in S3 buckets, making it an effective tool for ensuring compliance with data classification requirements.
- B. Incorrect.
Manually tagging each S3 object is prone to human error, time-consuming, and not scalable for large data sets. It is not a recommended approach for effective data classification.
- C. Correct.
AWS Glue Data Catalog allows you to define metadata, including classifications, at the table and column level. This is useful for managing and cataloging datasets based on their sensitivity and compliance requirements.
- D. Incorrect.
Encrypting data at rest with AWS KMS is a security best practice but does not inherently classify the data. Encryption ensures data protection but does not address classification requirements.
- E. Correct.
AWS Config rules can be used to monitor S3 bucket policies and ensure compliance with organizational standards, which is critical for maintaining proper data classification and security.