DEA-C01 Practice Question 30: Redshift Dynamic Data Masking
AWS Certified Data Engineer – Associate (DEA-C01) · Test 3 · question 10 of 10
A customers table in Amazon Redshift contains a ssn column. Three groups query it through the same BI tool and the same table name:
- fraud investigators must see the full value, - support agents must see only the last four digits, - everyone else must see a fully redacted value.
Dozens of saved BI reports already select from public.customers, and the compliance team will not accept storing a second copy of the data.
Which solution meets these requirements?
Show answer and explanation
Answer:
Dynamic data masking is the Redshift feature designed for this exact shape of requirement. It lets you "manipulate how Amazon Redshift shows sensitive data to the user at query time, without transforming it in the database", through "masking policies that apply custom obfuscation rules to a given user or role." Policies can "partially or completely redact data", which covers both the last-four case and the fully redacted case. You can "apply multiple masking policies with varying levels of obfuscation to the same column in a table and assign them to different roles", and set priorities so the right one wins when a user holds more than one role. Nothing is stored twice and no report changes, because every group keeps querying public.customers.
Option B works functionally but fails the stated constraints. Every saved report has to be repointed at a different object name, and the mapping has to be maintained as roles change; the report churn is the cost the masking feature exists to avoid.
Option C can only grant or withhold an entire column. Column-level privileges have no notion of showing part of a value, so there is no way to give support agents the last four digits: they either see the whole SSN or the query fails.
Option D creates the second copy compliance rejected, and it is applied at load time, so the decision is frozen into the data. Changing a group's entitlement would mean reloading the table, and the raw value the fraud investigators need still has to be stored and protected somewhere.
Reference: Dynamic data masking in Amazon Redshift