AWS Glue Studio PII Obfuscation for S3 Data Lake
A data engineer must use AWS services to ingest a dataset into an Amazon S3 data lake. The data engineer profiles the dataset and discovers that the dataset contains personally identifiable information (PII). The data engineer must implement a solution to profile the dataset and obfuscate the PII. Which solution will meet this requirement with the LEAST operational effort?
Answer
Correct answer: B — Use the AWS Glue Studio Detect PII transform to identify and obfuscate PII, orchestrated by Step Functions.
Community Votes
71% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The Detect PII transform in AWS Glue Studio natively supports obfuscation, making separate Data Quality rules or custom Lambda code unnecessary and increasing operational effort.
AWS Glue Studio provides a native Detect PII transform that can both identify and obfuscate personally identifiable information with minimal operational effort. This page establishes that using Glue Studio combined with Step Functions orchestration is the optimal low-code solution over custom Lambda or invalid Data Quality rules.
Choosing C because of the assumption that Glue Data Quality is needed for obfuscation; Data Quality only validates data, it cannot obfuscate PII.
Community Discussion (28 comments)
Devarsh Sanghvi
👍 1
Selected: C
B identifies PII while C does obfuscate it.
Kalyso
👍 2
Selected: B
Actually it is B. No need to create a rule in AWS Glue.
Devarsh Sanghvi
👍 1
True no need to create a true it's configured from glue studio itself or maybe passed as params while using this transformation via code
plutonash
👍 2
Selected: C
B. Use the Detect PII transform in AWS Glue Studio to identify the PII. Obfuscate the PII. Use an AWS Step Functions state machine to orchestrate a data pipeline to ingest the data into the S3 data lake. Detect PII transform only detects. Obfuscate the PII ok but how ? Answer C explain how
Udyan
👍 1
Selected: C
Why C is better than B: Obfuscation clarity: Option C explicitly mentions using a Glue Data Quality rule to obfuscate PII, while option B does not specify how obfuscation is implemented. Accuracy: Glue Data Quality provides a more structured way to handle obfuscation compared to relying solely on Glue Studio's PII detection. Thus, C is the most accurate and operationally efficient solution.
markill123
👍 1
The keyt
antun3ra
👍 2
Selected: B
B provides a streamlined, mostly visual approach using purpose-built tools for data processing and PII handling, making it the solution with the least operational effort.
portland
👍 1
Selected: C
https://aws.amazon.com/blogs/big-data/automated-data-governance-with-aws-glue-data-quality-sensitive-data-detection-and-aws-lake-formation/
portland
👍 1
Actually it is B
qwertyuio
👍 2
Selected: B
https://docs.aws.amazon.com/glue/latest/dg/detect-PII.html
bakarys
👍 1
Selected: C
anwser is C
Khooks
👍 5
Selected: B
Option C involves additional steps and complexity with creating rules in AWS Glue Data Quality, which adds more operational effort compared to directly using AWS Glue Studio's capabilities.
bigfoot1501
👍 3
I don't think we need to use much more services to fulfill these requirements. Just AWS Glue is enough, it can detect and obfuscate PII data already. Source: https://docs.aws.amazon.com/glue/latest/dg/detect-PII.html#choose-action-pii
VerRi
👍 3
Selected: C
We cannot directly handle PII with Glue Studio, and Glue Data Quality can be used to handle PII.
Just_Ninja
👍 1
Selected: A
A very easy was is to use the SDK to identify PII. https://docs.aws.amazon.com/code-library/latest/ug/comprehend_example_comprehend_DetectPiiEntities_section.html
kairosfc
👍 3
Selected: C
The transform Detect PII in AWS Glue Studio is specifically used to identify personally identifiable information (PII) within the data. It can detect and flag this information, but on its own, it does not perform the obfuscation or removal of these details. To effectively obfuscate or alter the identified PII, an additional transformation would be necessary. This could be accomplished in several ways, such as: Writing a custom script within the same AWS Glue job using Python or Scala to modify the PII data as needed. Using AWS Glue Data Quality, if available, to create rules that automatically obfuscate or modify the data identified as PII. AWS Glue Data Quality is a newer tool that helps improve data quality through rules and transformations, but whether it's needed will depend on the functionality's availability and the specificity of the obfuscation requirements
okechi
👍 2
Answer is option C. Period
arvehisa
👍 4
Selected: B
B is correct. C: glue data quality cannot obfuscate the PII D: need to write code but the question is the "LEAST operational effort"
certplan
👍 2
In python --- from awsglue.utils import getResolvedOptions from pyspark.context import SparkContext from awsglue.context import GlueContext from pyspark.sql import SparkSession # Initialize Spark session spark = SparkSession.builder \ .appName("Example Glue Job") \ .getOrCreate() # Initialize Glue context glueContext = GlueContext(SparkContext.getOrCreate()) # Retrieve Glue job arguments args = getResolvedOptions(sys.argv, ['JOB_NAME']) # Define your EMR step emr_step = [ { "Name": "My EMR Step", "ActionOnFailure": "CONTINUE", "HadoopJarStep": { "Jar": "s3://your-bucket/emr-scripts/your_script.jar", "Args": [ "arg1", "arg2" ] } } ] # Execute the EMR step response = glueContext.start_job_run(args['JOB_NAME'], job_run_args={'--extra-py-files': 'your_script.py'}) print(response)
certplan
👍 2
B. Utilizes AWS Glue Studio for PII detection, AWS Step Functions for orchestration, and S3 for storage. Glue Studio simplifies PII detection, and Step Functions can streamline the data pipeline orchestration, potentially reducing operational effort compared to option A. C. Similar to option B, but it additionally includes AWS Glue Data Quality for obfuscating PII. This might add a bit more complexity but can also streamline the process if Glue Data Quality offers convenient features for PII obfuscation.
milofficial
👍 12
Selected: B
How does Data Quality obfuscate PII? You can do this directly in Glue Studio: https://docs.aws.amazon.com/glue/latest/dg/detect-PII.html
Eleftheriia
👍 2
Yes, and regarding the "Create a rule in AWS Glue Data Quality to obfuscate the PII. " which is included in answer C, it cannot be done like this because in the aws glue console there is a section, "detect sensitive data" and then "types of sensitive information to detect". Therefore through this console you can obfuscate PII. Relevant tutorial: https://www.youtube.com/watch?v=-TZZBfcnxBw
jellybella
👍 4
Selected: B
AWS Glue Data Quality is a feature that automatically validates the quality of the data during a Glue job run, but it's not typically used for data obfuscation.
GiorgioGss
👍 1
Selected: C
https://dev.to/awscommunity-asean/validating-data-quality-with-aws-glue-databrew-4df4 https://docs.aws.amazon.com/glue/latest/dg/detect-PII.html
BartoszGolebiowski24
👍 1
I think this is A. We ingest data to s3 with a PPI transformation. We do not need to use glue, or step function here in that case.
BartoszGolebiowski24
👍 1
But in the other case, if this is a one-time operation, Answer: C should be better. The phrase "ingestion" case me think, that this is the stream of data. To sum up. One time: Answer C. Stream: Answer A.
rralucard_
👍 2
Selected: C
Option C seems to be the best solution to meet the requirement with the least operational effort. It leverages AWS Glue Studio for PII detection, AWS Glue Data Quality for obfuscation, and AWS Step Functions for orchestration, minimizing the need for custom coding and manual processes.
TonyStark0122
👍 1
C. Use the Detect PII transform in AWS Glue Studio to identify the PII. Create a rule in AWS Glue Data Quality to obfuscate the PII. Use an AWS Step Functions state machine to orchestrate a data pipeline to ingest the data into the S3 data lake
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option B correctly leverages the native capabilities of AWS Glue Studio's Detect PII transform, which can both identify and obfuscate PII without requiring custom code or additional rules. By using a Step Functions state machine for orchestration, it provides a fully managed, low-operational-effort pipeline to ingest the obfuscated data into Amazon S3. This aligns perfectly with the requirement to minimize operational overhead while effectively handling PII.Why the Other Options Are Wrong
Option A introduces high operational effort by requiring custom AWS Lambda code to identify and obfuscate PII, and using Kinesis Data Firehose is unnecessarily complex for a standard dataset ingestion. Option C incorrectly attempts to use AWS Glue Data Quality to obfuscate PII; Data Quality is used for validation rules, not data masking or obfuscation. Option D drastically increases operational effort by routing data through Amazon DynamoDB and writing custom Lambda code for both PII handling and S3 ingestion.Community Comment Notes
Commenters correctly point out that Glue Data Quality cannot obfuscate PII, invalidating Option C. As milofficial noted, "You can do this directly in Glue Studio". Users like Khooks and arvehisa agree that adding Data Quality rules increases operational effort unnecessarily. The documentation confirms that the Detect PII transform natively supports actions like Obfuscate, Remove, or Detect.Official Reference
Exam Strategy
When a question asks for the "LEAST operational effort" for data transformation, prioritize native, visual, or declarative AWS features over custom code in AWS Lambda. Remember that AWS Glue Data Quality is for validation, not transformation or obfuscation.
Related Analysis
Practice All DEA-C01 Questions
Access 100 questions with complete answers and detailed explanations.
View Full DEA-C01 Practice Test →