Q62 — AWS SAA-C03 Ch.16

Question 62 of 100 | ← Chapter 16

Q1262. A company needs to process data from multiple users. The company stores the data in a relational database.A solutions architect needs to extract the data, use business rules to transform the data,and store the data in Amazon S3.The solutions architect must ensure that the data is encrypted during processing.Which solution will meet these requirements with the LEAST operational effort?

• A. Use AWS Glue ETL jobs that use AWS KMS to provide built-in encryption. Configure an AWS Glue job to transform the data. Store the transformed data in a separate S3 bucket for each user. Encrypt each bucket with a KMS key that is specific to each user. ✓
• B. Use Amazon EMR clusters with encryption settings. Create one cluster for each user. Use AWS KMS keys to encrypt the data at rest and in transit.
• C. Use AWS Database Migration Service (AWS DMS) with encryption enabled. Configure one replication task for each user to extract and load data into a separate S3 bucket for each user. Encrypt each bucket with a KMS key that is specific to each user.
• D. Use AWS Lambda functions that run in response to database changes. Process data in memory, with encryption enabled. Write the processed data to Amazon S3. Use server-side encryption (SSE).

Correct Answer: A. Use AWS Glue ETL jobs that use AWS KMS to provide built-in encryption. Configure an AWS Glue job to transform the data. Store the transformed data in a separate S3 bucket for each user. Encrypt each bucket with a KMS key that is specific to each user.

Explanation

The correct answer is A. Use AWS Glue ETL jobs that use AWS KMS to provide built-in encryption. Configure an AWS Glue job to transform the data. Store the transformed data in a separate S3 bucket for each user. Encrypt each bucket with a KMS key that is specific to each user.Explanation:The company needs a solution that:Extracts data from a relational database.Transforms it using business rules.Stores it in Amazon S3 with encryption.Minimizes operational effort (automated, scalable, and easy to manage).AWS Glue is the best choice because:Fully managed ETL service (no infrastructure management).Built-in encryption via AWS KMS (both at rest and in transit). Serverless architecture (scales automatically, reduces operational overhead). Supports per-user S3 buckets with KMS encryption (fine-grained security).Why Option A is Correct:AWS Glue ETL Jobs:Automates extraction, transformation, and loading (ETL).Integrates natively with relational databases (JDBC connectors).Supports PySpark/Scala for business logic.AWS KMS Encryption:Encrypts data at rest in S3 (SSE-KMS).Encrypts data in transit (TLS between Glue and S3/database).Allows per-user KMS keys (granular access control).Least Operational Effort:No cluster management (unlike EMR).No manual scaling (unlike Lambda with complex workflows).Centralized job scheduling (via AWS Glue triggers or EventBridge).Why the Other Options Are Incorrect:B. Amazon EMR with encryption (per-user clusters)High operational overhead (managing multiple clusters).Expensive (EMR clusters are costlier than Glue).Not serverless (requires scaling and maintenance).C. AWS DMS with per-user replication tasksDesigned for database migration, not complex transformations. Limited ETL capabilities (better suited for CDC, not business rules). Still requires additional processing (e.g., Lambda or Glue for transformations).D. AWS Lambda with in-memory processingNot ideal for large-scale ETL (Lambda has memory/timeout limits). Requires custom encryption logic (Glue handles this natively). More complex to orchestrate (vs. Glue's built-in workflows). Alternative Consideration (If Per-User Buckets Are Not Required):If separate S3 buckets per user are unnecessary, a simpler approach would be:Use a single AWS Glue job to process all users' data.Store in a single S3 bucket with KMS encryption (using a single CMK or different keys per partition).Reduces bucket management overhead.However, Option A still meets the requirement of per-user buckets with encryption while minimizing effort via Glue's automation.Conclusion:Option A is the best choice because:AWS Glue provides a fully managed, scalable ETL solution.KMS encryption ensures security with minimal setup.Per-user buckets are supported without manual infrastructure management.Least operational effort compared to EMR, DMS, or Lambda.Final Answer:A