DEA-C01 Question 476
Select 2An e-commerce company is designing a data pipeline to process and store customer data, including sensitive PII (Personally Identifiable Information), in Amazon S3. The company wants to ensure that all sensitive fields are encrypted at rest and anonymized when accessed by downstream analytics teams. Which of the following steps should you take to meet these requirements?
- A
Enable default encryption on the S3 bucket using an AWS Key Management Service (KMS) key.
- B
Use AWS Glue DataBrew to mask sensitive fields before making the data available for analytics.
- C
Enable S3 Object Lock to ensure the data cannot be accidentally deleted or overwritten.
- D
Use Amazon Macie to discover and classify PII in the data and automatically encrypt it.
- E
Implement client-side encryption before uploading data to Amazon S3 for additional security.
Show answer and explanation
Correct answers: A, B
Explanation
To meet the requirements, the data must be encrypted at rest and sensitive fields masked for analytics. Enabling default encryption on the S3 bucket ensures that data is encrypted at rest using AWS KMS. AWS Glue DataBrew can be used to mask sensitive fields, ensuring that downstream users access anonymized data. Other options either do not address the specific requirements or are redundant given the scenario.
- A. Correct.
Enabling default encryption in the S3 bucket with an AWS KMS key ensures that data is encrypted at rest, meeting the encryption requirement.
- B. Correct.
AWS Glue DataBrew provides tools to mask sensitive fields, which is necessary for anonymizing data before analytics use.
- C. Incorrect.
S3 Object Lock is used for data immutability and does not directly address encryption or masking requirements.
- D. Incorrect.
Amazon Macie helps in discovering and classifying PII but does not handle encryption or masking; it is more focused on monitoring and compliance.
- E. Incorrect.
Client-side encryption can provide additional security, but it is not required if the S3 bucket already has server-side encryption enabled with AWS KMS.