DEA-C01 Data Security and Governance Practice Question
A data engineer is building an AWS Glue job that reads a table from the AWS Glue Data Catalog. The table contains columns with customer names, email addresses, and account numbers. The security team wants the job to mask the last four digits of account numbers in the output while leaving other columns unchanged. Which approach should the data engineer use?
⚠ Common exam trap
Candidates often confuse PII detection with PII masking; detection identifies sensitive data but does not alter it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a DynamicFrame map transformation with a custom function that replaces the account number value with a masked version.
Masking specific column values during a Glue ETL run is best done with a map transformation that applies a custom function to each record. This keeps the transformation inside the job, gives full control over the masking logic, and leaves other columns unchanged. PII detection, DataBrew recipes, and column-level encryption do not perform value-level masking in this context.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the AWS Glue DataBrew masking recipe and apply it as a transformation step in the Glue job.
Why it's wrong here
DataBrew recipes are applied within DataBrew jobs or through the DataBrew API, not as native steps inside an AWS Glue ETL script. There is no supported way to embed a DataBrew recipe directly in a Glue job's transform chain. While DataBrew can mask data, this integration path does not exist, so it cannot satisfy the requirement in this scenario.
- ✗
Apply a DynamicFrame map transformation and call the PII detection transform on the account number column.
Why it's wrong here
The PII detection transform identifies potential personally identifiable information but does not mask or transform values by itself. It returns detection results that you would still need to act on with a separate transformation. Using it alone would not produce the masked account numbers the security team requires, so it does not meet the masking requirement.
- ✓
Use a DynamicFrame map transformation with a custom function that replaces the account number value with a masked version.
Why this is correct
A DynamicFrame map transformation applies a user-defined function to each record, allowing the job to rewrite only the account number column while leaving other columns untouched. This gives precise control over the masking logic, such as keeping the last four digits. It runs natively inside the Glue job and produces the required masked output.
- ✗
Enable column-level encryption on the Data Catalog table definition for the account number column.
Why it's wrong here
Column-level encryption in the Data Catalog protects statistics and metadata for a column; it does not transform data values during an ETL job. Enabling it would not mask account numbers in the output and could interfere with the job's ability to read column statistics. This is a metadata protection feature, not a data masking mechanism.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DEA-C01 question from scratch — 1,321 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.