DEA-C01 Practice Question 10: Glue Detect PII Hash Masking
AWS Certified Data Engineer – Associate (DEA-C01) · Test 1 · question 10 of 10
CSV extracts from dozens of upstream partners land in the raw zone of a data lake and are transformed by a single AWS Glue ETL job. Some extracts carry US Social Security numbers and phone numbers, and which column holds them varies by partner and occasionally changes without notice.
Compliance requires that these values must not be readable in the curated zone. Analysts must still be able to join curated tables on the affected values, so identical inputs must produce identical replacement values. The control has to run inside the existing Glue job, before the curated data is written, and must keep working when a partner starts putting a Social Security number in a column it never used before.
What should the data engineer implement?
Show answer and explanation
Answer:
The Detect PII transform "provides the ability to detect, mask, or remove entities that you define, or are pre-defined by AWS", and it runs as a step inside the Glue ETL job, so the masking happens in flight, before anything is written to the curated zone. Detection is driven by entity patterns rather than by a fixed column list, so a Social Security number that suddenly appears in a new column is still found. The "Apply cryptographic hash" action "pass[es] the detected PII value to a SHA-256 cryptographic hash function and replace[s] the value with the function's output". Because SHA-256 is deterministic, equal inputs yield equal hashes, which is what preserves the analysts' ability to join on the value while leaving the original unreadable.
Option C uses the same transform with the wrong action. Redaction replaces the detected value with a fixed string, ******* when no replacement text is given, so every affected row collapses to the same token and the join requirement is destroyed.
Option A uses a discovery service as if it were a transformation service. Macie inspects Amazon S3 objects and reports findings; it does not rewrite data, and the values would still be written to the curated zone in the clear. A findings-derived column list is also always one job behind: it cannot cover a column that a partner started populating since the last discovery run.
Option D leaves the sensitive values sitting in the curated zone in plaintext, protected only by a grant that any future misconfiguration or broader grant can undo. It also fails the stated requirement outright: a column an analyst cannot select is a column an analyst cannot join on.
Reference: Detect and process sensitive data