SAA-C03 Q321 · Analytics

Question

A solutions architect is building an Amazon S3 data lake for a company. The company uses Amazon Kinesis Data Firehose to ingest customer personally identifiable information (PII) and transactional data in near real- time to an S3 bucket. The company needs to mask all PII data before storing the data in the data lake. Which solution will meet these requirements?

Accepted Answer

**Answer A** satisfies every requirement:

1. **Near real-time processing**: Kinesis Data Firehose natively supports **data transformation** by invoking an AWS Lambda function on each batch of records *before* delivering them to the destination (S3). This means PII is masked **in-flight**, before it ever lands in the S3 data lake.

2. **PII masking**: The Lambda function can use pattern matching (regex), Amazon Comprehend's `DetectPiiEntities` API, or custom logic to identify PII fields (names, SSNs, emails, etc.) and replace them with masked/hashed values.

3. **Before storing in the data lake**: Because the transformation happens within the Firehose delivery pipeline, the data written to S3 is already masked. There is no window where unmasked PII exists in the data lake.

4. **Simplicity

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips