DEA-C01 Question 542
Select 4You are working as a data engineer for a healthcare company that stores patient data in Amazon S3. The data contains personally identifiable information (PII), such as patient names, addresses, and social security numbers. Your team wants to ensure that the PII is protected while granting data analysts access to the dataset for analysis. Which of the following options can you implement to protect PII in compliance with security best practices?
- A
Use Amazon Macie to identify and classify sensitive data stored in S3.
- B
Encrypt the data in S3 using AWS Key Management Service (KMS) keys.
- C
Grant analysts full access to the S3 bucket to ensure they can query all data.
- D
Use AWS Glue Data Catalog to tag columns containing PII and apply column-level access control using Lake Formation.
- E
Anonymize or tokenize PII data using a solution like AWS Glue or a custom Lambda function before sharing it with analysts.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
Protecting PII in AWS involves a combination of identifying sensitive data, encrypting it, controlling access, and anonymizing or tokenizing it where necessary. Amazon Macie helps identify the presence of PII, encryption ensures data security at rest, Lake Formation can enforce fine-grained access controls, and anonymization/tokenization further reduces the risk of exposing sensitive information during data analysis. Granting unrestricted access to the dataset violates security best practices and should be avoided.
- A. Correct.
Amazon Macie helps to identify and classify sensitive data, including PII, stored in S3. This step assists in understanding where PII resides and how to secure it. It is a crucial part of protecting PII.
- B. Correct.
Encrypting the data in S3 using AWS KMS keys ensures that unauthorized users cannot access the data, even if they gain access to the storage layer, which is a best practice for PII protection.
- C. Incorrect.
Granting analysts full access to the S3 bucket exposes all the data, including PII, to unnecessary risk. This violates the principle of least privilege and is not a recommended approach.
- D. Correct.
Using AWS Glue Data Catalog to tag PII and applying column-level access controls via Lake Formation allows granular control over who can access sensitive data. This is a secure way to manage analyst access to PII.
- E. Correct.
Anonymizing or tokenizing PII before sharing it ensures that analysts can work with the data without direct exposure to sensitive information. This approach minimizes the risk of data breaches and aligns with security best practices.