DEA-C01 Data Security and Governance Practice Question

A company is designing a data lake on AWS and must comply with GDPR requirements. The company needs to implement data masking for personally identifiable information (PII) columns in Amazon Redshift. Which feature should be used?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create views in Redshift that apply masking functions

Amazon Redshift supports dynamic data masking through views that apply masking functions, such as using CASE statements or custom masking functions to obfuscate PII columns. Option A is incorrect because Amazon RDS Proxy is a connection proxy for RDS databases and does not provide data masking capabilities for Redshift. Option B is incorrect because Amazon S3 Object Lambda is used to transform data in S3, not to mask data in Redshift queries. Option D is incorrect because AWS Lake Formation row-level security filters rows based on permissions but does not mask or obfuscate column values; it is for access control, not data masking.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Use Amazon RDS Proxy to intercept queries
Why it's wrong here
RDS Proxy pools and multiplexes database connections; it never inspects or rewrites column values, so PII in Redshift remains exposed. It is tempting because it does sit between applications and databases, but its purpose is connection management for RDS and Aurora, not Redshift masking, which Redshift Dynamic Data Masking policies handle.
✗
Amazon S3 Object Lambda to mask data on the fly
Why it's wrong here
S3 Object Lambda transforms objects as they are retrieved from S3, so it never touches data already loaded into Redshift tables, leaving PII columns exposed to queries. Redshift's native column-level masking is the right control when the requirement is to obscure values inside the warehouse itself.
✓
Create views in Redshift that apply masking functions
Why this is correct
Dynamic data masking in Amazon Redshift applies masking policies at query time, so PII columns return redacted values without altering stored data. Attaching these policies to roles satisfies GDPR's data-minimisation requirement, and unlike views, masking persists across all queries against the table, including ad-hoc analyst access.
✗
AWS Lake Formation row-level security
Why it's wrong here
Lake Formation row-level security filters which rows a principal may read; it does not obscure individual column values, so PII would remain visible. Column masking in Redshift is the correct control when GDPR requires the values themselves to be hidden, while row filtering suits tenant-isolation scenarios.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DEA-C01 Data Security and Governance Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question