AWS Certified Data Engineer Associate DEA-C01 Practice Question

A media company stores incoming customer records in multiple Amazon S3 buckets registered with AWS Lake Formation. Data engineers must automatically discover PII in every new object and block Amazon Athena users who have the analyst role from querying PII columns, while minimizing ongoing code maintenance. Which solution meets these requirements?

Configure Amazon S3 Object Lambda to invoke a Lambda function that redacts PII at request time and direct analysts to query the data through the Object Lambda access points.
Schedule AWS Glue crawlers with custom classifiers to look for common PII patterns, then manually update Lake Formation permissions after each crawl to block analyst access to identified columns.
Enable Amazon Macie automated sensitive data discovery for the buckets, publish findings to Amazon EventBridge, invoke a Lambda function that adds an LF-tag such as pii=yes to the affected Glue Data Catalog columns, and create Lake Formation column-level permissions that deny the analyst role access to that tag.
Create AWS Config rules that detect unencrypted S3 objects and apply an IAM service control policy that blocks Athena queries against those objects across the account.

Report Issue

Answer Description

Amazon Macie is the managed service for automatically discovering sensitive data such as PII in Amazon S3. When a discovery job finds PII, Macie publishes the finding to Amazon EventBridge, where a Lambda function can update the AWS Glue Data Catalog and attach an LF-tag (for example, pii=yes) to the affected columns. Lake Formation column-level permissions can then deny Select access to that tag for the analyst role, preventing those users from querying PII through Athena. This approach is serverless and event-driven, so it scales across all buckets without manual intervention. The other options either rely on custom or manual crawlers, do not label data for Lake Formation, or focus on encryption rather than PII discovery, and therefore fail to satisfy both the automation and least-privilege requirements.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.