A Data Engineer needs to build a model using a dataset containing customer credit card information. How can the Data Engineer ensure the data remains encrypted and the credit card information is…

Question

Options

• AUse a custom encryption algorithm to encrypt the data and store the data on an Amazon
• BUse an IAM policy to encrypt the data on the Amazon S3 bucket and Amazon Kinesis to
• CUse an Amazon SageMaker launch configuration to encrypt the data once it is copied to the
• DUse AWS KMS to encrypt the data on Amazon S3 and Amazon SageMaker, and redact the credit

• A
  4% (2)
• B
  15% (8)
• C
  8% (4)
• D
  74% (39)

Explanation

AWS Key Management Service (KMS) is the AWS-native, recommended approach for managing encryption keys at rest. It integrates natively with both Amazon S3 (server-side encryption via SSE-KMS) and Amazon SageMaker (encrypting notebook EBS volumes, training job storage, and model artifacts). Redacting the actual credit card numbers (e.g., replacing with tokens or masked values) from the dataset adds a critical second layer of protection - even if the encrypted storage were compromised, the raw PAN data would not be present. Option A's custom encryption is an anti-pattern (never roll your own crypto). Option B is wrong because IAM policies control access, not encryption. Option C is incorrect because SageMaker launch configurations do not perform data encryption.

No community discussion yet for this question.