DEA-C01 Question 534
Select 3Your organization has set up an Amazon S3 data lake to store sensitive customer information, including personally identifiable information (PII). To comply with data privacy regulations such as GDPR and CCPA, you need to implement mechanisms to protect this data and ensure proper governance. Which of the following actions should you take to meet compliance requirements?
- A
Enable Amazon S3 Server-Side Encryption (SSE) for all sensitive data.
- B
Implement Amazon Macie to automatically discover and classify sensitive data in the S3 buckets.
- C
Use AWS Identity and Access Management (IAM) policies to enforce least privilege access control.
- D
Enable versioning on the S3 buckets to retain a history of all object changes for compliance purposes.
- E
Set up an Amazon CloudWatch alarm to monitor S3 bucket activity for unauthorized access attempts.
Show answer and explanation
Correct answers: A, B, C
Explanation
To meet data privacy and governance requirements, data encryption, sensitive data classification, and access control are critical. Enabling Amazon S3 Server-Side Encryption ensures that data at rest is protected. Amazon Macie helps discover and classify sensitive data like PII, which is essential for compliance. Implementing IAM policies to enforce least privilege access ensures that sensitive data is only accessible to authorized users. While versioning and monitoring unauthorized access are useful features, they are not directly tied to data privacy and governance compliance.
- A. Correct.
This is correct because enabling S3 Server-Side Encryption ensures that data at rest is encrypted, which is a key requirement of many data privacy regulations.
- B. Correct.
This is correct because Amazon Macie uses machine learning to identify sensitive data such as PII, helping you understand and manage your compliance posture.
- C. Correct.
This is correct because enforcing least privilege with IAM policies ensures that only authorized users can access sensitive data, minimizing the risk of data breaches.
- D. Incorrect.
This is incorrect because while versioning is useful for data recovery and audit purposes, it is not directly related to meeting data privacy or governance requirements.
- E. Incorrect.
This is incorrect because monitoring unauthorized access attempts is important for security, but it does not directly address data privacy or governance compliance requirements.