Q24 — AWS SAA-C03 Ch.16

Question 24 of 100 | ← Chapter 16

Q1224. A company has an application that collects survey data and feedback from customers. The company logs customer responses to the surveys. The company frequently uses Amazon CloudWatch to access the logs. The company must ensure that personally identifiable information (PII) that customers enter into the application is not visible when the company accesses the logs.The company wants to ensure that any PII present in the logs is masked,regardless of the way the company accesses the log data.Which solution will meet these requirements?

Correct Answer: D. Create a CloudWatch data protection policy to mask PIl data when the company accesses the logs.

Explanation

To meet the requirement of masking personally identifiable information (PII) in CloudWatch logs regardless of how the log data is accessed, let's analyze the options:Key Requirements:Mask PII in Logs: The solution must ensure that PII is masked in the logs, preventing it from being visible when accessing the logs.Universal Masking: The masking must apply regardless of how the logs are accessed (e.g., via the CloudWatch Logs console, API, CLI, etc.).Solution Analysis:AWS Lambda for Log Processing:While AWS Lambda can be used to process logs (e.g., via a subscription filter), it would only mask PII in real-time as logs are generated. However, this does not guarantee that PII is masked when logs are accessed later (e.g., via the CloudWatch Logs console or API). Additionally, modifying logs after they are created is not straightforward, and this approach would not retroactively mask PII in existing logs.Amazon S3 and Amazon Macie:Exporting logs to S3 and using Macie to identify PII is useful for detecting PII in stored logs, but Macie does not automatically mask the PII in the logs. It only identifies and alerts on PII, leaving the original logs unchanged.Amazon Kinesis for Log Processing:Similar to Lambda, using Kinesis to mask PII would require real-time processing of logs as they are generated. This does not ensure that PII is masked when logs are accessed later, and it does not address existing logs.CloudWatch Data Protection Policy:CloudWatch Logs Insights and other CloudWatch features do not natively support a "data protection policy" that masks PII. However, AWS does offer CloudWatch Logs Insights with data masking capabilities via CloudWatch Logs Insights query filters or AWS Config rules for log data masking, but these are not as straightforward as a dedicated policy.The correct approach here is to use AWS CloudWatch Logs with a data masking solution that is integrated with CloudWatch. While AWS does not have a direct "CloudWatch data protection policy" as a standalone feature, the closest built-in solution is to use AWS CloudWatch Logs Insights with query-time masking or AWS Config rules to enforce masking. However, the question implies a more automated and universal solution.In practice, AWS offers AWS CloudWatch Logs with AWS Config rules or AWS Lambda-based masking for logs, but the most direct and correct answer in the context of the options provided is to use a CloudWatch-integrated masking solution, which is effectively a data protection policy (even if AWS does not call it that explicitly in the UI).Given the options, the intended correct answer is likely referring to a CloudWatch Logs data protection feature (even if it's not explicitly named in AWS documentation as a "policy").Evaluating the Options:Option A: Create an AWS Lambda function that runs when a new log stream is created. Configure the Lambda function to mask sensitive data in the logs.Incorrect: This only masks PII in real-time as logs are generated and does not ensure masking when logs are accessed later.Option B: Set up a subscription to export log data to an Amazon S3 bucket. Configure Amazon Macie to identify PII in the data.Incorrect: Macie identifies PII but does not mask it in the logs. Option C: Set up a subscription to export log data to an Amazon Kinesis data stream. Use Kinesis to mask PII in the data.Incorrect: This only masks PII in real-time as logs are generated and does not ensure masking when logs are accessed later.Option D: Create a CloudWatch data protection policy to mask PII data when the company accesses the logs.Correct (intended): While AWS does not explicitly call it a "CloudWatch data protection policy," this is the closest option that implies a built-in or automated masking solution for CloudWatch logs. In practice, AWS Config rules or Lambda-based solutions can be used to enforce masking, but the question is likely referring to a CloudWatch-integrated masking feature.Final Answer:D. Create a CloudWatch data protection policy to mask PII data when the company accesses the logs.(Note: In practice, AWS does not have a direct "CloudWatch data protection policy" feature, but this is the most plausible answer among the options provided. The actual implementation might involve AWS Config rules, Lambda-based masking, or query-time filtering in CloudWatch Logs Insights.)