DEA-C01 Data Ingestion and Transformation Practice Question

A company uses Amazon Kinesis Data Firehose to deliver data to an S3 bucket. The data contains personally identifiable information (PII) that must be redacted before storage. Which TWO actions can achieve this requirement? (Choose TWO.)

⚠ Common exam trap

The trap is that candidates may assume Macie can automatically redact PII, but it only discovers and classifies; it cannot modify data without additional services like Lambda. Thus, Option C is not a correct answer.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use AWS Glue ETL to read from the S3 bucket and write redacted data to another S3 bucket.

Option A is correct because AWS Glue ETL jobs can read the raw data from the S3 bucket, apply transformation logic (such as masking or removing PII fields), and write the redacted output to another S3 bucket, satisfying the requirement that PII be redacted before storage in the destination. Option E is correct because Kinesis Data Firehose supports Lambda-based record transformation, where a Lambda function is invoked on each incoming record to redact PII before Firehose delivers the data to S3, which is the most direct in-stream solution. Option B is not correct because Amazon Athena is a query service that reads data already stored in S3; it cannot redact PII before storage. Option C is not correct because Amazon Macie discovers and classifies sensitive data but does not automatically redact or modify it. Option D is not correct because AWS DMS is designed for database migration and replication, not for transforming and redacting PII in a Firehose-to-S3 data pipeline.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Use AWS Glue ETL to read from the S3 bucket and write redacted data to another S3 bucket.
Why this is correct
Correct. AWS Glue ETL can perform schema-aware transformations, including redacting PII fields, and write to a target S3 bucket.
✗
Use Amazon Athena to query the data and redact PII on the fly.
Why it's wrong here
Incorrect. Amazon Athena is a query service, not a transformation service; it cannot redact data before storage.
✗
Use Amazon Macie to discover and automatically redact PII before storage.
Why it's wrong here
Incorrect. Amazon Macie discovers and classifies PII but does not have built-in redaction capabilities; additional automation is required.
✗
Use AWS Database Migration Service (AWS DMS) to replicate data and apply transformations.
Why it's wrong here
Incorrect. AWS DMS is for database migrations, not for ingesting data into S3 via Kinesis Firehose.
✓
Use an AWS Lambda function as a transformation in the Firehose delivery stream.
Why this is correct
Correct. An AWS Lambda function can be invoked by Firehose to transform records, including redacting PII, before delivery to S3.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DEA-C01 Data Ingestion and Transformation Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question