Exam-style
A retailer is preparing data for an Amazon Bedrock knowledge base: customer tables catalogued in the AWS Glue Data Catalog, plus the source documents behind them in Amazon S3. Analysts in one country must not see another country's rows. No document may be altered or deleted for seven years. No batch over a set proportion of empty fields may load. Which classification, with the feature carrying each?
Reveal the answer
B. Data access control, data integrity, assessing data quality: AWS Lake Formation data filters on the catalogued tables, with IAM and bucket policies underneath; S3 versioning with S3 Object Lock in compliance mode; AWS Glue Data Quality rules that fail the load
Sort each requirement by what it acts on. The first acts on the reader: the rows stay, and which come back varies by analyst. That is data access control, and AWS Lake Formation applies row- and column-level data filters over Glue Data Catalog tables, with IAM and bucket policies underneath. Privacy-enhancing technologies strip or obscure a value; nothing here does. The second acts on the object over time: data integrity, from S3 versioning and S3 Object Lock in compliance mode. The third acts on the batch: a Glue Data Quality Completeness rule set to fail without loading the target. The fourth option pairs those properties with wrong mechanisms: KMS decrypts for any role with access, CloudTrail records a deletion rather than preventing it, and a DataBrew profile reports without stopping the load. IAM expresses no row filter; Macie only reports.
Q. One corpus, three requirements: analysts must not see another country’s customers, source documents must be unalterable for seven years, and thin batches must not load. Which property is each?
A. Data access control, data integrity, and assessing data quality, in that order: AWS Lake Formation data filters, S3 Object Lock, and AWS Glue Data Quality rules.
Why? Ask what each requirement acts on. Acting on the reader is data access control. The rows stay, and Lake Formation data filters return different rows and columns to different roles over the catalogued tables, with IAM and bucket policies underneath. Acting on the object over time is data integrity. S3 versioning keeps the earlier copy, and Object Lock in compliance mode means no principal, the root user included, can shorten the seven years or delete the locked version. Acting on the batch before it lands is assessing data quality. A Glue Data Quality Completeness rule in the ETL job, set to fail without loading the target, stops the run. A DataBrew profile only reports the null rate. Privacy-enhancing technologies are the fourth property, and they apply when a value itself has to be stripped or obscured. Amazon Macie sits outside all four. It finds the sensitive data so you know which property to apply.