DEA-C01 Data Security and Governance Practice Question

Correct answer & explanation

Options B and D are correct. Option B: Storing database credentials in AWS Secrets Manager and referencing them in AWS Glue connections ensures that sensitive credentials are not hard-coded or exposed in plaintext, following security best practices for PII data. Option D: Configuring AWS Glue to use a KMS key for encrypting data written to S3 ensures that data at rest in S3 is encrypted with customer-managed keys, providing additional control over encryption. Option A is incorrect because S3 default encryption with SSE-S3 uses Amazon-managed keys and does not provide the same level of control as KMS; more importantly, the question asks for actions to protect PII, and using SSE-S3 alone is not sufficient for compliance with many regulations that require encryption with customer-managed keys. Option C is incorrect because enabling S3 object deletion protection with a retention policy is about preventing accidental deletion, not directly about protecting data from unauthorized access or encryption. Option E is incorrect because HTTPS encrypts data in transit, but the question also requires encryption at rest; HTTPS alone does not protect data at rest in S3.