DOP-C02 · Question #380
A DevOps administrator is responsible for managing the security of a company's Amazon CloudWatch Logs log groups. The company's security policy states that employee IDs must not be visible in logs…
The correct answer is A. Create a new data protection policy on the log group. Add an Emp-\d{6} custom data identifier. AWS CloudWatch Logs data protection policies provide a way to mask sensitive data in log groups while still allowing authorized personnel to unmask them if necessary. The most operationally efficient solution involves: 1. Creating a data protection policy on the CloudWatch log…
Question
A DevOps administrator is responsible for managing the security of a company's Amazon CloudWatch Logs log groups. The company's security policy states that employee IDs must not be visible in logs except by authorized personnel. Employee IDs follow the pattern of Emp- XXXXXX, where each X is a digit. An audit discovered that employee IDs are found in a single log file. The log file is available to engineers, but the engineers are not authorized to view employee IDs. Engineers currently have an AWS IAM Identity Center permission that allows logs:* on all resources in the account. The administrator must mask the employee ID so that new log entries that contain the employee ID are not visible to unauthorized personnel. Which solution will meet these requirements with the MOST operational efficiency?
Options
- ACreate a new data protection policy on the log group. Add an Emp-\d{6} custom data identifier
- BCreate a new data protection policy on the log group. Add managed data identifiers for the
- CCreate an AWS Lambda function to parse a log file entry, remove the employee ID, and write the
- DCreate an Amazon Data Firehose delivery stream that has an Amazon S3 bucket as the
How the community answered
(32 responses)- A69% (22)
- B19% (6)
- C3% (1)
- D9% (3)
Explanation
AWS CloudWatch Logs data protection policies provide a way to mask sensitive data in log groups while still allowing authorized personnel to unmask them if necessary. The most operationally efficient solution involves: 1. Creating a data protection policy on the CloudWatch log group. 2. Defining a custom data identifier with the regex to detect employee IDs. 3. Applying an IAM policy that explicitly denies engineers the logs:Unmask permission, preventing them from viewing unmasked employee IDs.
Topics
Community Discussion
No community discussion yet for this question.