DEA-C01 Question 504
Select 2A healthcare company is building a data lake on Amazon S3 to store sensitive customer data, including personally identifiable information (PII). To ensure compliance with data privacy regulations, they need to anonymize the data before analysis. They also want to prevent unauthorized users from reversing the anonymization process. Which combination of approaches should the company use to meet these requirements?
- A
Use AWS Glue to hash PII fields with a cryptographic hash function such as SHA-256 and incorporate a salt for added security.
- B
Use Amazon Macie to mask sensitive data in real-time as it is uploaded to the S3 bucket.
- C
Replace PII fields with randomly generated tokens using Amazon DynamoDB and store the mapping table in an encrypted DynamoDB table.
- D
Encrypt PII fields using AWS Key Management Service (KMS) and allow authorized users to decrypt the data for analysis.
- E
Apply S3 Object Lock to the data to prevent unauthorized access and modifications.
Show answer and explanation
Correct answers: A, C
Explanation
To comply with data privacy regulations, the company must anonymize data to ensure that even if unauthorized access occurs, the original PII cannot be reconstructed. Hashing with cryptographic functions and salting ensures strong, irreversible anonymization. Tokenization with secure storage of the mapping table also provides a robust anonymization strategy while maintaining usability for authorized processes. Other options, such as encryption and S3 Object Lock, do not fulfill the specific requirement to anonymize the data, and Amazon Macie is not designed for real-time anonymization.
- A. Correct.
This is a correct option. Hashing PII fields with a cryptographic hash function and adding a salt makes it computationally infeasible for unauthorized users to reverse-engineer the original data.
- B. Incorrect.
Amazon Macie is a data discovery and classification service and does not perform real-time data masking or anonymization.
- C. Correct.
This is a correct option. Tokenization replaces sensitive data with tokens that can't be reversed without access to the mapping table, which can be stored securely in an encrypted DynamoDB table.
- D. Incorrect.
Encryption protects data but does not anonymize it. Authorized users could still access the original PII, which does not meet the requirement for anonymization.
- E. Incorrect.
S3 Object Lock prevents modification or deletion of objects but does not anonymize or mask data.