DEA-C01 Question 496
Select 3You are designing a data pipeline in AWS to process and store sensitive customer data. The data will be ingested into Amazon S3 and then processed using AWS Glue. To ensure compliance with data protection regulations, what steps should you take to protect the sensitive data during storage and processing?
- A
Enable server-side encryption (SSE) on the S3 bucket to encrypt data at rest.
- B
Use AWS Glue Data Catalog to automatically apply encryption to the processed data.
- C
Use AWS Key Management Service (KMS) to manage encryption keys for both S3 and Glue.
- D
Enable S3 bucket versioning to track changes to sensitive data.
- E
Restrict access to the S3 bucket and AWS Glue jobs using IAM policies and resource-based policies.
Show answer and explanation
Correct answers: A, C, E
Explanation
Protecting sensitive data in AWS requires implementing encryption for data at rest and ensuring secure key management using AWS KMS. Additionally, restricting access to resources with IAM and resource-based policies is crucial to prevent unauthorized access. While features like versioning and the AWS Glue Data Catalog offer valuable functionality, they do not directly address encryption or access control requirements for sensitive data.
- A. Correct.
Correct: Enabling server-side encryption ensures that the data stored in S3 is encrypted at rest, which is a critical step in protecting sensitive data.
- B. Incorrect.
Incorrect: While the AWS Glue Data Catalog is useful for metadata management, it does not automatically apply encryption to the processed data. Encryption must be configured separately.
- C. Correct.
Correct: AWS Key Management Service (KMS) provides a secure way to manage encryption keys for both S3 and Glue, ensuring proper key management for sensitive data.
- D. Incorrect.
Incorrect: While enabling S3 bucket versioning is useful for tracking changes, it does not directly contribute to protecting sensitive data during storage and processing.
- E. Correct.
Correct: Restricting access using IAM policies and resource-based policies ensures that only authorized entities can access the sensitive data and AWS resources, which is essential for data protection.