DEA-C01 Question 540
Select 3You are working as a data engineer for a healthcare company that processes sensitive patient data, including Personally Identifiable Information (PII). You need to design a solution in AWS to ensure PII is protected while allowing data analysts to perform analytics on anonymized data. Which combination of approaches should you implement?
- A
Use AWS Key Management Service (KMS) to encrypt data containing PII before storing it in Amazon S3.
- B
Implement Amazon Macie to classify and monitor PII in your data lake.
- C
Use Amazon S3 bucket policies to block all access to the data containing PII from external IP addresses.
- D
Apply AWS Glue DataBrew to mask PII data before making it available for analytics.
- E
Enable server-side encryption (SSE-S3) on all S3 buckets storing PII.
Show answer and explanation
Correct answers: A, B, D
Explanation
To protect PII while enabling analytics, AWS tools like KMS and Amazon Macie are essential for encrypting and monitoring sensitive data. Additionally, AWS Glue DataBrew can anonymize or mask PII, ensuring compliance with privacy regulations while allowing safe use of the data for analytics. Blocking external IP addresses and enabling SSE-S3 are useful security measures but do not directly address the anonymization requirement.
- A. Correct.
Correct: Using AWS KMS to encrypt data ensures that PII is protected, and access to the encryption keys can be tightly controlled using IAM policies.
- B. Correct.
Correct: Amazon Macie helps identify and classify PII in your data lake, providing visibility and monitoring to ensure compliance with data protection policies.
- C. Incorrect.
Incorrect: While blocking external IP addresses can add some security, it does not specifically address the requirement to anonymize PII for analytics.
- D. Correct.
Correct: AWS Glue DataBrew can mask or anonymize PII, making it safe for use in analytics while complying with data privacy requirements.
- E. Incorrect.
Incorrect: Enabling server-side encryption (SSE-S3) provides encryption at rest but does not address the requirement to anonymize PII for analytics.