DOP-C02 practice question 15 of 35

A company has an application that stores data that includes personally Identifiable Information (Pll) In an Amazon S3 bucket All data Is encrypted…

A company has an application that stores data that includes personally Identifiable Information (Pll) In an Amazon S3 bucket All data Is encrypted with AWS Key Management Service (AWS KMS) customer managed keys. All AWS resources are deployed from an AWS Cloud Formation template. A DevOps engineer needs to set up a development environment for the application in a different AWS account The data in the development environment's S3 bucket needs to be updated once a week from the production environment's S3 bucket. The company must not move Pll from the production environment without anonymizmg the Pll first The data in each environment must be encrypted with different KMS customer managed keys. Which combination of steps should the DevOps engineer take to meet these requirements? (Select TWO )

Answer options

A: Activate Amazon Macie on the S3 bucket In the production account Create an AWS Step Functions state machine to initiate a discovery job and redact all Pll before copying files to the S3 bucket in the development account. Give the state machine tasks decrypt permissions on the KMS key in the production account. Give the state machine tasks encrypt permissions on the KMS key in the development account

B: Set up S3 replication between the production S3 bucket and the development S3 bucket Activate Amazon Macie on the development S3 bucket Create an AWS Step Functions state machine to initiate a discovery job and redact all Pll as the files are copied to the development S3 bucket. Give the state machine tasks encrypt and decrypt permissions on the KMS key in the development account.

C: Set up an S3 Batch Operations job to copy files from the production S3 bucket to the development S3 bucket. In the development account, configure an AWS Lambda function to redact all Pll. Configure S3 Object Lambda to use the Lambda function for S3 GET requests Give the Lambda function's 1AM role encrypt and decrypt permissions on the KMS key in the development account.

D: Create a development environment from the CloudFormatlon template in the development account. Schedule an Amazon EventBridge rule to start the AWS Step Functions state machine once a week

E: Create a development environment from the CloudFormation template in the development account. Schedule a cron job on an Amazon EC2 instance to run once a week to start the S3 Batch Operations job.

Correct Answer:

Explanation

Activate Amazon Macie on the Production S3 Bucket: Macie can identify and protect sensitive data such as PII. Create a Step Functions state machine to automate data discovery and redaction before copying it to the development environment. Example Step Functions state machine:
{
"Comment": "Anonymize PII and copy data", "StartAt": "MacieDiscoveryJob",
"States": {
"MacieDiscoveryJob": {
"Type": "Task", "Resource": "arn:aws:states:::macie:startClassificationJob", "End": true
}
}
}
Create a Development Environment from CloudFormation Template: Deploy the development environment in a new account using the existing CloudFormation template. Schedule an EventBridge rule to start the Step Functions state machine on a weekly basis. EventBridge rule example:
{
"ScheduleExpression": "rate(7 days)", "StateMachineArn": "arn:aws:states:::stateMachine:AnonymizeAndCopyData"
}
By using Macie for data anonymization and Step Functions for automation, you ensure PII is properly handled before data transfer between environments.
Reference: Amazon Macie AWS Step Functions AWS CloudFormation Templates

Keep practicing

Take the free DOP-C02 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test