DVA-C02 · Question #792
A company runs an internal reporting application that has hundreds of AWS Lambda functions. The company must protect personally identifiable information (PII) that appears in the company's Amazon Clou
The correct answer is B. Apply a CloudWatch data protection policy that uses a custom data identifier to the company's. A CloudWatch data protection policy can be applied at the account level to automatically detect and redact sensitive data in CloudWatch Logs before it is stored. By using a custom data identifier, the company can define patterns that match company-specific PII such as employee ID
Question
A company runs an internal reporting application that has hundreds of AWS Lambda functions. The company must protect personally identifiable information (PII) that appears in the company's Amazon CloudWatch Logs log groups. The company deploys a Lambda layer to redact generic PII, such as email addresses. A developer must ensure that company-specific PII, such as employee IDs, does not appear in the CloudWatch logs. Which solution will meet these requirements?
Options
- ARun an Amazon Macie sensitive data discovery job. Use a Lambda function to redact the Macie
- BApply a CloudWatch data protection policy that uses a custom data identifier to the company's
- CApply a CloudWatch data protection policy that uses a managed data identifier to the company's
- DRun an Amazon Macie sensitive data discovery job. Use an AWS Systems Manager Automation
How the community answered
(36 responses)- A11% (4)
- B78% (28)
- C8% (3)
- D3% (1)
Explanation
A CloudWatch data protection policy can be applied at the account level to automatically detect and redact sensitive data in CloudWatch Logs before it is stored. By using a custom data identifier, the company can define patterns that match company-specific PII such as employee IDs, ensuring this data is redacted from all Lambda-generated logs without modifying existing functions or relying on post-processing.
Community Discussion
No community discussion yet for this question.