DEA-C01 Question 210
Single answerA company is building a data lake on Amazon S3 to store and analyze vast amounts of data from multiple sources. The data includes personally identifiable information (PII), financial data, and publicly available data. To comply with regulatory and internal security requirements, the company must classify the data and apply appropriate controls before ingestion. Which approach should the company take to classify and manage the data effectively?
- A
Use AWS Glue Data Catalog to automatically classify data based on its schema and apply tags for PII and sensitive data.
- B
Manually review all data files before ingestion and assign labels for PII and financial data.
- C
Leverage Amazon Macie to scan, classify, and secure sensitive data such as PII, and apply tags for further processing.
- D
Use AWS Config to define custom rules for classifying data and enforce security policies.
Show answer and explanation
Correct answer: C
Explanation
Amazon Macie is the appropriate service for discovering and classifying sensitive data such as PII in Amazon S3. It provides capabilities like automated data discovery, classification, and security management, making it an ideal choice for the described scenario. Other options either lack the required functionality or are not scalable for this use case.
- A. Incorrect.
AWS Glue Data Catalog can help manage metadata for data stored in Amazon S3 but does not automatically classify data based on its sensitivity or detect PII.
- B. Incorrect.
Manually reviewing data files is highly time-consuming, error-prone, and not scalable for large datasets.
- C. Correct.
Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and classify sensitive data, such as PII, in S3. It is the right tool for this use case.
- D. Incorrect.
AWS Config is primarily used to monitor and enforce compliance with AWS resource configurations. It is not suitable for data classification.