Exam-style
A retailer is building a Bedrock knowledge base over a corpus of source documents held in Amazon S3 and catalogued in the AWS Glue Data Catalog. Three requirements are attached to it. Analysts in one country must not see rows for customers in another. Nobody must be able to alter or delete a source document during its seven-year retention window. And no incoming batch carrying more than a set proportion of empty fields may be loaded at all. Which classification of the three, with the feature that carries each, is right?
Reveal the answer
B. Data access control, then data integrity, then assessing data quality: AWS Lake Formation row- and column-level grants over the catalogued data with IAM and bucket policies underneath, S3 versioning with S3 Object Lock in compliance mode, and AWS Glue Data Quality rules that fail the batch
Sort each requirement by what it acts on. The first acts on the reader: the customer rows stay in the corpus, the analysts in the other country still need them, and what changes is which rows come back for whom. That is data access control, and AWS Lake Formation is the layer that does it at row and column granularity over data catalogued in the AWS Glue Data Catalog, with IAM policies and S3 bucket policies underneath deciding who reaches the bucket at all. It reads like a privacy requirement because it mentions customers in another country, and privacy-enhancing technologies are the fourth property in secure data engineering, so the first option is the one worth slowing down on. Reach for them when the requirement is to strip or obscure the identifiers themselves, as in redacting a national identifier or swapping a customer name for a stable pseudonym. Nothing here asks for a value to be changed. The second requirement acts on the object over time: it is data integrity, carried by S3 versioning so an overwrite leaves the earlier version recoverable, and S3 Object Lock in compliance mode so the retention cannot be shortened or the object deleted by anybody, including an administrator or the account root user. The third acts on the batch before it lands, so it is assessing data quality, and an AWS Glue Data Quality ruleset with a completeness rule fails the run rather than loading it. The fourth option picks the right three properties and the wrong three mechanisms. Encryption with AWS KMS controls nothing about who may read a decrypted row, since every role with access decrypts transparently on the way through. AWS CloudTrail records who called what, which tells you a document was deleted rather than preventing it. And an AWS Glue DataBrew profile draws the null rate rather than gating on it, so the thin batch loads while somebody looks at a chart. The third option collapses everything into IAM, which cannot express a row filter and cannot bind a retention window that an administrator is unable to lift. Amazon Macie is none of the four: it discovers where sensitive data sits in S3 and reports it, which is how a team learns which requirement it needs, not how any of them is met.
Q. One corpus, three requirements: analysts must not see another country’s customers, source documents must be unalterable for seven years, and thin batches must not load. Which property is each?
A. Data access control, data integrity, and assessing data quality, in that order: AWS Lake Formation grants, S3 Object Lock, and AWS Glue Data Quality rules.
Why? Ask what each requirement acts on. Acting on the reader is data access control: the rows stay, and Lake Formation returns different rows and columns to different roles over the catalogued data, with IAM and S3 bucket policies underneath. Acting on the object over time is data integrity: S3 versioning keeps the earlier copy, and S3 Object Lock in compliance mode means nobody can shorten the seven years or delete inside them. Acting on the batch before it lands is assessing data quality: a Glue Data Quality completeness rule fails the run, where a DataBrew profile would only report the null rate and let the load through. Privacy-enhancing technologies are the fourth property and would be the answer if a value itself had to be stripped or obscured, which none of these three ask for. Amazon Macie sits outside all four; it finds the sensitive data so you know which property to apply.