Q29 — AWS SAA-C03 Ch.16

Question 29 of 100 | ← Chapter 16

Q1229. A company is building an internal expense management tool for employees. After employees enter their expense data into a form, the tool sends report data to a third-party REST API for validation and approval. The company must protect sensitive data from specific fields when the reports are sent to the third-party API.Which solution will meet these requirements?

Correct Answer: B. Update the tool to upload the reports to Amazon S3. Configure Amazon Macie to use managed data identifier rules to detect the sensitive data. Create an AWS Lambda function to mask the sensitive data.Invoke Amazon Simple Notification Service (Amazon SNS) to send the reports.

Explanation

To meet the requirement of protecting sensitive data from specific fields when sending expense reports to a third-party REST API, let's analyze the options:Key Requirements:Protect Sensitive Data: The solution must mask or remove sensitive data from the reports before they are sent to the third-party API.Direct Integration with Third-Party API: The solution should facilitate sending the reports to the third-party API after processing.Solution Analysis:Option A: Update the tool to use Amazon SNS to send reports. Add a data protection policy to Amazon SNS. Use managed data identifier rules to mask the sensitive data. Incorrect: Amazon SNS is a messaging service for publishing messages to subscribers (e.g., HTTP, email, SMS). It does not natively support data masking or transformation of message content before delivery. While AWS does offer data protection features in some services, SNS is not designed for this purpose. Option B: Update the tool to upload the reports to Amazon S3. Configure Amazon Macie to use managed data identifier rules to detect the sensitive data. Create an AWS Lambda function to mask the sensitive data. Invoke Amazon SNS to send the reports.Partially Correct (But Not Optimal): This approach involves multiple steps (S3 upload, Macie detection, Lambda masking, SNS publishing). While it could work, it is overly complex for the requirement. Macie is primarily for detecting sensitive data in S3 buckets, not for real-time transformation of data before sending it to an API. Additionally, SNS is not the best choice for sending structured data to a REST API. Option C: Update the tool to upload the reports to Amazon SQS. Configure an AWS Glue DataBrew job to use a ruleset to tag sensitive data with a metadata tag. Create an AWS Lambda function to mask tagged data. Use Amazon SNS to send the reports.Incorrect: This approach is also overly complex and not well-suited for the requirement. SQS is a message queue service, not designed for direct integration with REST APIs. Glue DataBrew is for data preparation and transformation, but it is not the best tool for real-time masking of data before sending it to an API. SNS is again not the right choice for sending structured data to a REST API. Option D: Update the tool to use Amazon SNS to send the reports. Add a data protection policy to Amazon SNS. Create a custom data identifier rule to mask the sensitive data. Attach the rules to the data protection policy.Incorrect (But Close): As mentioned earlier, SNS does not natively support data masking or transformation of message content. While AWS is expanding its data protection capabilities, SNS is not the right service for this use case. The idea of creating a custom data identifier rule and attaching it to a data protection policy is conceptually correct, but SNS is not the service where this would be implemented.Correct Approach (Not Fully Listed in Options):The best approach would involve:Processing the Data Before Sending: Use a service that can intercept and transform the data before it is sent to the third-party API.AWS Lambda or API Gateway:Lambda: Could be used to process the data (mask sensitive fields) and then call the third-party API. API Gateway: Could be used with a Lambda integration to process the request before forwarding it to the third-party API.Evaluating the Given Options:Given the options, none perfectly fit the requirement, but Option B is the closest in terms of using AWS services to detect and mask sensitive data, even though it is overly complex and not the most efficient. However, the question seems to expect an answer based on the given options, and Option B is the only one that involves detecting and masking sensitive data, even if it is not the most straightforward solution.Final Answer (Based on Given Options):B. Update the tool to upload the reports to Amazon S3. Configure Amazon Macie to use managed data identifier rules to detect the sensitive data. Create an AWS Lambda function to mask the sensitive data. Invoke Amazon Simple Notification Service (Amazon SNS) to send the reports.Note: While this is the best available option among the choices, a more efficient solution would involve processing the data directly (e.g., using Lambda) before sending it to the third-party API, without involving S3, Macie, and SNS in this manner. The question may have intended to test knowledge of AWS services for data protection, even if the setup is not ideal for the use case.