DEA-C01 Question 533
Select 3A company is building a data lake on Amazon S3 to store sensitive customer information. To comply with data privacy regulations like GDPR and CCPA, the company must ensure proper governance and protection of sensitive data. Which of the following actions should be taken to meet these compliance requirements?
- A
Enable S3 Object Lock to prevent accidental deletion of sensitive data.
- B
Use AWS Key Management Service (KMS) to encrypt data at rest in S3 with customer-managed keys.
- C
Implement Amazon Macie to identify and protect sensitive data such as personally identifiable information (PII).
- D
Configure S3 bucket policies to allow public read access for transparency.
- E
Set up AWS Lake Formation to manage access control and enforce data governance policies.
Show answer and explanation
Correct answers: B, C, E
Explanation
To comply with data privacy regulations such as GDPR and CCPA, the company must encrypt sensitive data using AWS KMS, use Amazon Macie to discover and classify sensitive information, and utilize AWS Lake Formation to enforce access control and governance policies. These actions ensure that the data is adequately protected and managed in line with regulatory requirements.
- A. Incorrect.
While S3 Object Lock can help prevent accidental or malicious deletion of objects, it is not specifically designed for ensuring compliance with data privacy regulations or protecting sensitive data.
- B. Correct.
Using AWS KMS to encrypt data at rest with customer-managed keys ensures that sensitive data is protected and meets compliance requirements for encryption.
- C. Correct.
Amazon Macie is a managed service that uses machine learning to automatically discover, classify, and protect sensitive data in AWS, including PII, which is crucial for data privacy compliance.
- D. Incorrect.
Allowing public read access to S3 buckets would violate data privacy regulations and expose sensitive data, making it an inappropriate solution for this scenario.
- E. Correct.
AWS Lake Formation provides centralized control over permissions and access to data lakes, helping enforce governance and compliance policies effectively.