A company is using an Amazon Redshift database as its single data source. Some of the data is sensitive. A data scientist needs to use some of the sensitive data from the database. An ML engineer…

Question

Options

• AConfigure dynamic data masking policies to control how sensitive data is shared with the data
• BCreate a materialized view with masking logic on top of the database. Grant the necessary read
• CUnload the Amazon Redshift data to Amazon S3. Use Amazon Athena to create schema-on-read
• DUnload the Amazon Redshift data to Amazon S3. Create an AWS Glue job to anonymize the

• A
  57% (17)
• B
  13% (4)
• C
  7% (2)
• D
  23% (7)

Explanation

Dynamic Data Masking (DDM) in Amazon Redshift lets you define masking policies that automatically obscure sensitive column values for specific users or roles at query time - no data transformation, no extra storage, no ETL required. This makes Option A the lowest-effort solution because it works directly on the existing source data without any pipeline or schema changes.

Why the distractors fail:

• B (Materialized view): Creates a separate stored copy of the data in the database, which violates the "no anonymized data stored in the database" requirement.
• C (Athena schema-on-read): Requires unloading data to S3 and building an Athena layer - significant infrastructure effort compared to a single policy configuration.
• D (Glue job): Also requires unloading to S3 and writing/maintaining a Glue ETL job to anonymize - the most implementation effort of all options.

Memory tip: Think of Dynamic Data Masking as a "filter on the lens, not the source" - the underlying data never changes, only what specific users see is masked. Anytime an exam question says "no transformation, no extra storage, least effort," reach for DDM first.

No community discussion yet for this question.