Identifying and Removing Sensitive Data in a Hybrid Cloud Model with Amazon Macie and Lambda
Short answer
C Macie automatically discovers sensitive data in S3 with no code, and Lambda functions consume the findings to remove it, with nothing to provision.
Question
Key Takeaways
Amazon Macie is a managed service that automatically discovers and classifies sensitive data in S3 with no custom code, and it integrates with Lambda so the discovered sensitive fields can be masked or removed programmatically without managing any infrastructure.
A model deployed on premises in a hybrid cloud environment reads data in S3 to provide a live conversational engine, and that data contains sensitive information that must be identified and removed. The solution has to work across the hybrid boundary and run with the least operational overhead.
Common mistake: Deploying the model to SageMaker or an ECS Fargate cluster just to get a compute environment for the masking logic, which adds container and cluster management to a task that a managed discovery service plus a Lambda function already solves.
Expert Analysis
Why the Answer Is Correct
The task splits cleanly into two parts: identifying the sensitive data and removing it. Amazon Macie is the managed service built to discover and classify sensitive information in S3 automatically, with no custom code, which is the least operational overhead for the identification half. Because Macie reports what it finds programmatically, a set of Lambda functions can consume those findings and remove or mask the sensitive values, which handles the removal half with no infrastructure to manage. The two services together cover the requirement without moving the model out of the on-premises environment. The vote was unanimous at 100 for C. Saransundar summarized the split concisely as Macie for identifying sensitive data, and Sid4ops noted that Macie automates the process that makes the whole approach low overhead.Why the Other Options Are Wrong
Deploying the model on Amazon SageMaker and creating Lambda functions to identify and remove the sensitive data (A) misassigns the work, because SageMaker is a managed environment for training, deploying, and hosting models, not a sensitive data discovery service, so nothing in it identifies the sensitive fields. Deploying the model on an ECS cluster using Fargate and creating an AWS Batch job (B) has the same category error compounded by more infrastructure, since a Fargate cluster and a Batch job add container and job management on top of a discovery capability neither provides. Using Amazon Comprehend to identify the sensitive data and launching EC2 instances to remove it (D) fails on both halves: Comprehend is a natural language processing service for entities, sentiment, and key phrases rather than a general sensitive data scanner, and standing up EC2 instances to do the removal is the highest-overhead option in the list.Community Comment Notes
The community was unanimous at 100 for C, and the comments are brief but all point the same way. Saransundar laid out the two-step split of the answer, identifying sensitive data with Macie. Sid4ops added that Macie automates the process, which is precisely why it carries the least operational overhead. GiorgioGss observed that Comprehend can also handle PII, so option D is not entirely without merit on the identification side, but paired it with the observation that launching EC2 instances for the removal step is the wrong operational choice, which leaves C as the only option whose two halves are both low overhead.Official Reference
This link opens the official vendor documentation in a new tab.
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
Saransundar 👍 3 Answered CMacie - Identify sensitive data
-
GiorgioGss 👍 1 Answered CThis is the purpose of Macie. Comprehend will work also for PII but that EC2...
-
Sid4ops 👍 1 Answered CMacie: Automate processe helps in handle the sensitive data
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All MLA-C01 Questions
Access 115 questions with complete answers and detailed explanations.
View Full MLA-C01 Practice Test →