Masking and Securing PII in AWS Data Pipelines

DEA-C01 By islever Editorial Last updated Oct 15, 2026

Automate data processing by using AWS services. Apply authorization mechanisms.

Short answer

AD Use AWS Glue DataBrew to mask PII data and IAM to manage secure access permissions.

Question

A company saves customer data to an Amazon S3 bucket. The company uses server-side encryption with AWS KMS keys (SSE-KMS) to encrypt the bucket. The dataset includes personally identifiable information (PII) such as social security numbers and account details. Data that is tagged as PII must be masked before the company uses customer data for analysis. Some users must have secure access to the PII data during the pre-processing phase. The company needs a low-maintenance solution to mask and secure the PII data throughout the entire engineering pipeline. Which combination of solutions will meet these requirements? (Choose two.)

Use AWS Glue DataBrew to perform extract, transform, and load (ETL) tasks that mask the PII data before analysis. Correct Answer
Use Amazon GuardDuty to monitor access patterns for the PII data that is used in the engineering pipeline.
Configure an Amazon Macie discovery job for the S3 bucket.
Use AWS Identity and Access Management (IAM) to manage permissions and to control access to the PII data. Correct Answer
Write custom scripts in an application to mask the PII data and to control access.

Key Takeaways

It tests the ability to distinguish between automated data transformation tools (DataBrew) for masking and identity management services (IAM) for access control, avoiding manual scripting or unrelated security monitors.

This question addresses how to automatically mask Personally Identifiable Information (PII) in S3 using AWS Glue DataBrew while securing access via IAM policies.

Common mistake: Candidates often select Amazon Macie (C), which only discovers/finds PII but does not mask it, failing the requirement to 'mask' the data before analysis.

Expert Analysis

Why the Answer Is Correct

AWS Glue DataBrew is a visual data preparation tool that allows users to clean and normalize data without writing code; it includes built-in recipe steps for detecting and masking sensitive information like SSNs, satisfying the low-maintenance masking requirement. IAM (Option D) is the standard mechanism for managing permissions and controlling who can access specific S3 buckets or objects, ensuring secure access during the pre-processing phase.

Why the Other Options Are Wrong

Amazon Macie (C) is excellent for discovering PII but does not perform the actual masking action required by the prompt. GuardDuty (B) is a threat detection service, not a data processing or access control tool. Custom scripts (E) violate the 'low-maintenance' constraint compared to managed services like DataBrew.

Community Comment Notes

Community consensus strongly supports AD, with comments noting that DataBrew handles the masking and IAM handles the access. One user referenced an official AWS blog post detailing exactly this pipeline architecture.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When asked for 'low-maintenance' solutions for data tasks, always look for managed services (like Glue, EMR Serverless) rather than custom code. For access questions involving specific data types, combine the processing tool with IAM for granular permission control.

Frequently Asked Questions

Why isn't Amazon Macie the correct answer for masking PII?

Macie discovers and classifies PII but does not have a native feature to mask or redact the data in place. DataBrew is designed for the transformation/masking step.

Can I use Lambda instead of DataBrew for masking?

Yes, but Lambda requires custom coding and maintenance. The question specifies a 'low-maintenance' solution, making the managed visual tool DataBrew the better fit.

More DEA-C01 FAQ →

Community Votes

100%

100% of anonymous learners picked answer AD. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

emupsx1 👍 1

https://aws.amazon.com/tw/blogs/big-data/build-a-data-pipeline-to-automatically-discover-and-mask-pii-data-with-aws-glue-databrew/
MerryLew 👍 1

A will find and mask the PII D for access
HagarTheHorrible 👍 1

A for data maskin and D for access

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All DEA-C01 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DEA-C01 Practice Test →

← Back to DEA-C01 Study Guide