Skill 1.2.8: Mask, redact, and anonymize data
| Question | Answer & Explanation |
|---|---|
| ### Question 1 - Identifying AWS Services for PII Discovery A financial services company stores terabytes of customer support chat logs and transaction receipts as unstructured text files in an Amazon S3 bucket. The data engineering team needs to locate which specific files contain personally identifiable information (PII) before building a data transformation pipeline. The solution must operate with the least operational overhead and require no custom data science code. Which AWS service should the team use to discover the sensitive data in S3? (Select ONE) - A) Amazon Comprehend Custom Classification - B) Amazon Macie - C) AWS Glue DataBrew Data Profiling - D) Amazon Rekognition |
Correct Answer: B Correct Answer Analysis: - B is Correct: Amazon Macie is a fully managed data security and data privacy service that automatically discovers and protects sensitive data in Amazon S3. It uses machine learning to recognize sensitive data patterns such as PII without requiring custom code or infrastructure, satisfying the least operational overhead constraint. Distractor Analysis: - A is Incorrect: While Amazon Comprehend can detect PII in text, using Custom Classification requires training a custom model, which violates the "no custom data science code" and "least operational overhead" constraints. (Comprehend's built-in PII detection is for processing, not discovery across an S3 estate). - C is Incorrect: AWS Glue DataBrew can profile data for statistical anomalies and column types, but it does not natively scan and report on PII across an S3 estate the way Macie does. - D is Incorrect: Amazon Rekognition is for image and video analysis (e.g., detecting faces or objects in images), not for identifying PII in text files. > Exam Tip: Use Amazon Macie to discover sensitive data (PII, PHI) across Amazon S3, and use Amazon Comprehend to detect and redact PII inside text documents. |
| ### Question 2 - Masking vs. Redaction vs. Anonymization A retail company is preparing an ML dataset containing customer purchase histories. The dataset has a credit_card_number column. The engineering team needs to process this column such that the structural shape (length and data type) remains intact for downstream legacy validation scripts, but the actual sensitive values are hidden.Which data protection technique should the engineering team apply? (Select ONE) - A) Anonymization - B) Redaction - C) Masking - D) Tokenization |
Correct Answer: C Correct Answer Analysis: - C is Correct: Masking hides the actual value while keeping the shape and data type of the original data intact (e.g., replacing all but the last four digits of a credit card with asterisks). This satisfies the requirement to maintain structural shape for legacy validation scripts. Distractor Analysis: - A is Incorrect: Anonymization changes the data so that an individual can no longer be identified. This alters the data fundamentally rather than just hiding the value while keeping its shape. - B is Incorrect: Redaction completely removes the sensitive data value, which would break the required structural shape and likely fail the legacy validation scripts. - D is Incorrect: Tokenization replaces sensitive data with non-sensitive tokens. While useful, tokenization substitutes the whole value rather than simply hiding it while maintaining the exact shape/format. > Exam Tip: Masking keeps the shape but hides the value; Redaction removes the value entirely; Anonymization alters data so the individual cannot be identified. |
| ### Question 3 - Pre-Processing for Foundation Model Pre-Training An AI engineering team is assembling a massive corpus of unlabeled medical documents to perform continued pre-training on a foundation model using Amazon Bedrock. The raw documents contain Protected Health Information (PHI) that must not be learned by the model. The team must ensure zero PHI retention in the training data. At what point in the pipeline should the redaction of PHI occur? (Select ONE) - A) After the model finishes pre-training, to clean the source bucket - B) Before the data is fed into the pre-training job - C) During model inference, by applying Bedrock Guardrails - D) After chunking the documents for a RAG vector store |
Correct Answer: B Correct Answer Analysis: - B is Correct: Redaction must occur before the data is fed into the pre-training pipeline. Anything left in the training data can be absorbed into the model's weights and potentially surface in model outputs later. Distractor Analysis: - A is Incorrect: If redaction occurs after pre-training, the model has already been trained on the raw PHI data, defeating the purpose of the redaction requirement. - C is Incorrect: Bedrock Guardrails are applied at inference time to filter inputs/outputs. They do not prevent the model's internal weights from learning PHI during the pre-training phase. - D is Incorrect: The scenario specifies continued pre-training, not Retrieval-Augmented Generation (RAG). Chunking is a RAG preparation step, not a pre-training step. > Exam Tip: Always redact or anonymize sensitive data before it enters any training, fine-tuning, or pre-training pipeline to ensure it is never baked into model weights. |
| ### Question 4 - Real-Time PII Masking in a Streaming Pipeline A live chat application streams customer messages into Amazon Kinesis Data Streams. The data engineering team needs to mask sensitive information (like phone numbers and emails) in real-time before the data is persisted to an Amazon S3 data lake. The solution must be event-driven and minimize infrastructure management. Which architecture meets these requirements with the LEAST operational overhead? (Select TWO) - A) Configure an AWS Lambda function to process records from the stream. - B) Deploy a continuously running Amazon EC2 instance running Apache Spark. - C) Use Amazon Comprehend PII detection API inside the processing compute. - D) Use AWS Glue DataBrew to visually profile the streaming data. - E) Use Amazon Macie to scan the data before it hits S3. |
Correct Answers: A and C Correct Answer Analysis: - A is Correct: AWS Lambda can be triggered directly by Kinesis Data Streams to process records in a serverless, event-driven manner, minimizing infrastructure overhead. - C is Correct: The Lambda function can invoke the Amazon Comprehend PII detection API to identify entities and apply masking to the text payload before writing it to S3. Distractor Analysis: - B is Incorrect: Running a continuously managed EC2 instance with Spark introduces significant operational overhead and is not an event-driven, serverless architecture. - D is Incorrect: AWS Glue DataBrew is designed for visual batch data preparation, not for real-time stream processing. - E is Incorrect: Amazon Macie is used for discovering sensitive data at rest in S3, not for real-time data transformation/masking in a streaming pipeline. > Exam Tip: For real-time, event-driven stream processing with minimal overhead, use AWS Lambda. To detect and redact PII in text without custom NLP models, call Amazon Comprehend within Lambda. |
| ### Question 5 - Redacting PII for RAG Ingestion A legal firm is building a Retrieval-Augmented Generation (RAG) application using Amazon Bedrock Knowledge Bases. The source documents are legal case files stored in Amazon S3. The firm has a strict compliance policy: client names and addresses must be removed from the text entirely before they are chunked and converted into vector embeddings. Which approach ensures compliance with zero PII in the vector store? (Select ONE) - A) Enable Amazon Bedrock Guardrails to filter PII during inference. - B) Use Amazon Comprehend to detect and redact PII from the text files before pointing the Bedrock Knowledge Base data source to them. - C) Use Amazon Macie to automatically redact PII in the S3 bucket. - D) Configure OpenSearch Serverless to encrypt the PII at rest using a KMS key. |
Correct Answer: B Correct Answer Analysis: - B is Correct: Amazon Comprehend provides a PII detection and redaction API that processes text and returns a version with the sensitive entities removed. Running this as a pre-processing step guarantees that zero PII enters the Bedrock Knowledge Base vector store. Distractor Analysis: - A is Incorrect: Bedrock Guardrails filter outputs at inference time. They do not prevent PII from being ingested, chunked, and stored as embeddings in the vector store. - C is Incorrect: Amazon Macie discovers and reports sensitive data in S3; it does not modify or redact the files. - D is Incorrect: Encrypting data at rest (KMS) protects against unauthorized access to the storage layer, but the PII is still functionally present in the vector embeddings and could be retrieved by the LLM. > Exam Tip: To ensure sensitive data never reaches a vector database, run Amazon Comprehend's redaction job on the S3 documents before configuring them as a data source for Bedrock Knowledge Bases. |
| ### Question 6 - Anonymization for Public Data Release A data science team is preparing a dataset of user demographics for a public research competition. The dataset includes Age and Zip Code. The team must ensure that no individual can be re-identified from the released data, but they want to retain the general statistical distribution of these features for machine learning models.Which transformation technique should the team apply? (Select ONE) - A) Redaction - B) Log Transformation - C) Generalization / Binning - D) One-Hot Encoding |
Correct Answer: C Correct Answer Analysis: - C is Correct: Generalization or Binning (e.g., converting specific ages into age ranges like 20-30, and zip codes into larger geographical regions) changes the data so an individual cannot be identified while preserving the overall statistical distribution. This is a classic form of anonymization/de-identification. Distractor Analysis: - A is Incorrect: Redaction would remove the Age and Zip Code columns entirely, destroying the statistical value needed for ML models.- B is Incorrect: Log transformation scales numerical data to handle skewness but does not prevent re-identification of exact values. - D is Incorrect: One-Hot Encoding turns categorical variables into binary columns but preserves the exact original distinct values, meaning individuals can still be identified by their unique combination of traits. > Exam Tip: Anonymization often involves techniques like generalization or binning to de-identify records while preserving the statistical properties necessary for ML training. |
| ### Question 7 - Redaction Definition in Data Preparation An e-commerce company is using AWS Glue DataBrew to clean a dataset of customer service tickets. One of the columns, Customer_Notes, contains free-text where customers occasionally type their full Social Security Numbers (SSNs). The compliance team mandates that the SSNs be completely eliminated from the text, leaving a blank space or removing the sequence entirely.Which data protection technique is described here? (Select ONE) - A) Masking - B) Anonymization - C) Redaction - D) Standardization |
Correct Answer: C Correct Answer Analysis: - C is Correct: Redaction is the process of completely removing or eliminating the sensitive value from the dataset. The scenario explicitly requires the SSNs to be completely eliminated or removed, which matches the definition of redaction. Distractor Analysis: - A is Incorrect: Masking would hide the SSN (e.g., replacing digits with asterisks like XXX-XX-1234) but keep its structural shape in the text, which violates the mandate to eliminate it.- B is Incorrect: Anonymization involves changing the dataset so an individual cannot be identified. While redaction contributes to anonymization, redaction is the specific action of removing the text described here. - D is Incorrect: Standardization transforms data to a common format (e.g., converting all dates to YYYY-MM-DD), it does not deal with removing sensitive data.> Exam Tip: Redaction removes sensitive data entirely, whereas masking obscures it while retaining the format or shape of the data. |
| ### Question 8 - Discovering PII in Structured Databases A financial institution stores customer account records in an Amazon Redshift data warehouse. Before an ML engineer can build a feature engineering pipeline, they must identify which specific columns in the Transactions table contain sensitive data patterns (like bank routing numbers). The solution must be automated and managed by AWS.Which approach should the engineer use? (Select ONE) - A) Use Amazon Macie to scan the Redshift data warehouse. - B) Run an AWS Glue DataBrew profile job on the Redshift data source to evaluate column patterns and statistics. - C) Use Amazon Comprehend Medical to detect protected health information in the Redshift columns. - D) Enable Amazon S3 Server-Side Encryption (SSE-KMS) on the Redshift backups. |
Correct Answer: B Correct Answer Analysis: - B is Correct: AWS Glue DataBrew can connect directly to Amazon Redshift. Running a DataBrew profile job will analyze the dataset and generate column-level statistical reports, allowing the engineer to identify columns with specific patterns or data types that correspond to sensitive data. Distractor Analysis: - A is Incorrect: Amazon Macie is specifically designed to discover sensitive data in Amazon S3, not in relational databases or data warehouses like Amazon Redshift. - C is Incorrect: Amazon Comprehend Medical is designed to detect PHI in unstructured medical text, not to scan structured tabular columns in a data warehouse for bank routing numbers. - D is Incorrect: Encrypting backups protects data at rest from unauthorized access but does not help an engineer discover or identify which columns contain sensitive patterns. > Exam Tip: Remember that Amazon Macie is scoped specifically to Amazon S3. To profile and discover column characteristics in databases like Redshift or RDS, use AWS Glue DataBrew's data profiling capabilities. |
| ### Question 9 - Preparing Data for Fine-Tuning A company is preparing a dataset of labeled prompt-response pairs to fine-tune a foundation model in Amazon Bedrock. The dataset contains internal chat logs that include employee email addresses. The engineering team needs to ensure employee identities are protected by replacing the emails with a placeholder like [EMAIL].Which sequence of steps should the team take to prepare this data? (Select TWO) - A) Run an Amazon Comprehend PII detection job to identify the entity ranges. - B) Apply the redaction/masking transformation to replace the emails with [EMAIL].- C) Generate text embeddings using an Amazon Bedrock embedding model. - D) Store the data in an OpenSearch vector index. - E) Train an Amazon Rekognition custom model. |
Correct Answers: A and B Correct Answer Analysis: - A is Correct: Amazon Comprehend can process the chat logs to detect PII entities (like email addresses) and return their character offsets. - B is Correct: Using the entity offsets from Comprehend, the team can apply a transformation (redaction or masking) to replace the sensitive emails with the [EMAIL] placeholder before formatting the data as JSONL for fine-tuning.Distractor Analysis: - C is Incorrect: Fine-tuning a model for instruction following uses labeled prompt-response pairs (JSONL), not vector embeddings. Embeddings are used for RAG. - D is Incorrect: Storing data in an OpenSearch vector index is the final step of a RAG ingestion pipeline, not a supervised fine-tuning pipeline. - E is Incorrect: Amazon Rekognition is for image and video analysis and is irrelevant to processing text chat logs. > Exam Tip: When preparing data for Fine-Tuning, redact/mask PII first, then format to JSONL. When preparing for RAG, chunk text, embed, and store in a vector database. |
| ### Question 10 - Managed PII Redaction in Text Files A data engineer has a large batch of unstructured customer review text files stored in an Amazon S3 bucket. The engineer needs to remove all names, addresses, and credit card numbers from these files. The solution must be fully managed, require no custom NLP model training, and output the cleaned files back to S3. Which AWS service provides a built-in feature to directly redact PII from text files and output the results to S3? (Select ONE) - A) Amazon Macie - B) Amazon Comprehend - C) Amazon SageMaker Data Wrangler - D) Amazon Bedrock Guardrails |
Correct Answer: B Correct Answer Analysis: - B is Correct: Amazon Comprehend provides a native PII redaction feature. You can configure a redaction job that takes an S3 bucket as input, detects PII entities using pre-trained models, redacts them, and writes the output files back to a specified S3 bucket without writing custom code. Distractor Analysis: - A is Incorrect: Amazon Macie discovers and alerts on sensitive data in S3, but it does not modify or redact the files. - C is Incorrect: SageMaker Data Wrangler is an interactive tool for preparing tabular data for ML. It does not have a built-in managed text redaction job for unstructured S3 files. - D is Incorrect: Bedrock Guardrails apply to model inputs and outputs during inference, not to batch processing of files in S3. > Exam Tip: Amazon Comprehend is the go-to service for detecting and redacting PII in unstructured text documents. It has a specific API and console feature to run redaction jobs directly on S3 data. |