AWS Certified Data Engineer – AssociateData Governance and SecurityHard
A global company maintains a data lake on AWS S3, storing various datasets. Due to GDPR and other privacy regulations, the company must ensure that any data containing personal information is automatically identified and masked or redacted before being used for analytics by non-authorized personnel. Which AWS service can help automate the discovery of sensitive data and integrate with data governance workflows for masking?
- AAmazon Rekognition
- BAmazon Macie
- CAWS CloudTrail
- DAWS Config
Show answer & explanationAnswer & explanation
Correct answer: B. Amazon Macie
Amazon Macie is a data security and privacy service that uses machine learning and pattern matching to discover, classify, and protect sensitive data in AWS. It can automatically identify PII in S3 buckets and generate alerts, which can then be integrated into data governance workflows to trigger masking or redaction processes.
Why the other options are wrong
- A. Amazon Rekognition is for image and video analysis, not for identifying PII in text-based data lake files.
- C. AWS CloudTrail provides audit logs of API calls and user activity, not content inspection for sensitive data.
- D. AWS Config tracks configuration changes of AWS resources, not the content of data for sensitive information.
Amazon Macie
Amazon Macie is a data security and data privacy service that uses machine learning and pattern matching to discover, classify, and protect sensitive data in AWS, including PII in S3.
- Automated sensitive data discovery.
- Identifies PII, financial data, etc.
- Monitors S3 buckets for data security.
- Generates alerts for compliance and remediation.
Memory trick: Macie Maps My Sensitive Info