MLA-C01 Practice Question 22: PII Pseudonymization DataBrew
AWS Certified Machine Learning Engineer – Associate (MLA-C01) · Test 3 · question 2 of 10
Analysts prepare a marketing training dataset in AWS Glue DataBrew, without writing code. One column holds customer email addresses. Policy says the prepared dataset must not let anyone recover an email address, including the data team that owns the DataBrew project. The modeling team still needs to count how many events belong to the same customer, so two rows with the same original address must end up with the same value in that column. Which DataBrew recipe step meets both requirements?
Show answer and explanation
Answer:
CRYPTOGRAPHIC_HASH applies a hashing algorithm (HMAC-SHA256 by default, with the key held in AWS Secrets Manager) to the column. Hashing is one-way, so no one can turn the output back into an email address, and it is deterministic, so the same address always produces the same hash and rows for one customer still group together (option B).
- A is wrong because dropping the column also destroys the grouping key. Rows belonging to the same customer become indistinguishable, which is exactly what the modeling team needs. - C is wrong because deterministic encryption is reversible by design: DataBrew's DETERMINISTIC_DECRYPT step recovers the original values for anyone holding the secret, so the address is still recoverable by the data team. - D is wrong because a fresh random value per row breaks the grouping; two rows for the same customer get different substitutes, so per-customer counts become meaningless.
Reference: CRYPTOGRAPHIC_HASH