DEA-C01 Question 498
Select 3You are working as a data engineer for a financial institution that processes sensitive customer data, including personally identifiable information (PII). You are tasked with designing a data pipeline using Amazon S3, AWS Glue, and Amazon Redshift. Which of the following steps should you take to protect the sensitive data at rest and in transit?
- A
Enable server-side encryption (SSE) for Amazon S3 to encrypt data at rest.
- B
Use AWS Key Management Service (KMS) to manage encryption keys for sensitive data.
- C
Disable SSL when transferring data to Amazon Redshift to improve performance.
- D
Use AWS Glue to redact or mask sensitive data before loading it into Amazon Redshift.
- E
Store sensitive data in plaintext within Amazon S3 for ease of debugging.
Show answer and explanation
Correct answers: A, B, D
Explanation
Protecting sensitive data in AWS requires adopting encryption mechanisms for data at rest (e.g., SSE for Amazon S3) and in transit (e.g., using SSL). Additionally, AWS Glue can be used to redact or mask sensitive data to prevent unauthorized access during analytics. Managing encryption keys securely via AWS KMS is also a critical step. Avoid actions like disabling SSL or storing plaintext data, as they pose serious security risks.
- A. Correct.
This is correct because enabling server-side encryption (SSE) ensures that data at rest in Amazon S3 is encrypted, reducing the risk of unauthorized access.
- B. Correct.
This is correct because using AWS Key Management Service (KMS) provides a secure and managed way to handle encryption keys for sensitive data.
- C. Incorrect.
This is incorrect because disabling SSL would expose data in transit to potential interception, which is a security risk.
- D. Correct.
This is correct because redacting or masking sensitive data in AWS Glue before loading it into Amazon Redshift helps ensure sensitive information is protected during analytics and processing.
- E. Incorrect.
This is incorrect because storing sensitive data in plaintext within Amazon S3 is a significant security risk and violates best practices for protecting sensitive data.