Masking and Securing PII in AWS Data Pipelines
A company saves customer data to an Amazon S3 bucket. The company uses server-side encryption with AWS KMS keys (SSE-KMS) to encrypt the bucket. The dataset includes personally identifiable information (PII) such as social security numbers and account details. Data that is tagged as PII must be masked before the company uses customer data for analysis. Some users must have secure access to the PII data during the pre-processing phase. The company needs a low-maintenance solution to mask and secure the PII data throughout the entire engineering pipeline. Which combination of solutions will meet these requirements? (Choose two.)
Community Votes
100% of anonymous learners picked answer AD. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
It tests the ability to distinguish between automated data transformation tools (DataBrew) for masking and identity management services (IAM) for access control, avoiding manual scripting or unrelated security monitors.
This question addresses how to automatically mask Personally Identifiable Information (PII) in S3 using AWS Glue DataBrew while securing access via IAM policies.
Candidates often select Amazon Macie (C), which only discovers/finds PII but does not mask it, failing the requirement to 'mask' the data before analysis.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
AWS Glue DataBrew is a visual data preparation tool that allows users to clean and normalize data without writing code; it includes built-in recipe steps for detecting and masking sensitive information like SSNs, satisfying the low-maintenance masking requirement. IAM (Option D) is the standard mechanism for managing permissions and controlling who can access specific S3 buckets or objects, ensuring secure access during the pre-processing phase.Why the Other Options Are Wrong
Amazon Macie (C) is excellent for discovering PII but does not perform the actual masking action required by the prompt. GuardDuty (B) is a threat detection service, not a data processing or access control tool. Custom scripts (E) violate the 'low-maintenance' constraint compared to managed services like DataBrew.Community Comment Notes
Community consensus strongly supports AD, with comments noting that DataBrew handles the masking and IAM handles the access. One user referenced an official AWS blog post detailing exactly this pipeline architecture.Official Reference
Exam Strategy
When asked for 'low-maintenance' solutions for data tasks, always look for managed services (like Glue, EMR Serverless) rather than custom code. For access questions involving specific data types, combine the processing tool with IAM for granular permission control.
Frequently Asked Questions
Why isn't Amazon Macie the correct answer for masking PII?
Macie discovers and classifies PII but does not have a native feature to mask or redact the data in place. DataBrew is designed for the transformation/masking step.
Can I use Lambda instead of DataBrew for masking?
Yes, but Lambda requires custom coding and maintenance. The question specifies a 'low-maintenance' solution, making the managed visual tool DataBrew the better fit.
Related Analysis
Practice All DEA-C01 Questions
Access 100 questions with complete answers and detailed explanations.
View Full DEA-C01 Practice Test →