DAS-C01 · Question #169
A data architect is building an Amazon S3 data lake for a bank. The goal is to provide a single data repository for customer data needs, such as personalized recommendations. The bank uses Amazon…
The correct answer is A. Invoke an AWS Lambda function from Kinesis Data Firehose to mask PII before delivering the data into. Amazon Kinesis Data Firehose natively supports AWS Lambda as a data transformation step before delivery. By invoking a Lambda function from Firehose, you can inspect each record and mask or redact PII fields (e.g., replace values with tokens or hashes) before the data is…
Question
A data architect is building an Amazon S3 data lake for a bank. The goal is to provide a single data repository for customer data needs, such as personalized recommendations. The bank uses Amazon Kinesis Data Firehose to ingest customers’ personal information bank accounts, and transactions in near-real time from a transactional relational database. The bank requires all personally identifiable information (PII) that is stored in the AWS Cloud to be masked. Which solution will meet these requirements?
Options
- AInvoke an AWS Lambda function from Kinesis Data Firehose to mask PII before delivering the data into
- BUse Amazon Made, and configure it to discover and mask PII.
- CEnable server-side encryption (SSE) in Amazon S3.
- DInvoke Amazon Comprehend from Kinesis Data Firehose to detect and mask PII before delivering the
How the community answered
(24 responses)- A67% (16)
- B4% (1)
- C21% (5)
- D8% (2)
Explanation
Amazon Kinesis Data Firehose natively supports AWS Lambda as a data transformation step before delivery. By invoking a Lambda function from Firehose, you can inspect each record and mask or redact PII fields (e.g., replace values with tokens or hashes) before the data is written to the S3 data lake. This ensures PII is masked in motion, before it ever reaches storage. Option B references 'Amazon Made' (likely a typo for Amazon Macie), which is a data discovery and classification service - it identifies PII but does not mask it. Option C (S3 server-side encryption) encrypts data at rest but does not mask or anonymize PII values - authorized users can still read the raw PII. Option D is technically feasible conceptually but Firehose does not natively invoke Comprehend directly; Lambda is the correct integration mechanism.
Topics
Community Discussion
No community discussion yet for this question.