A company processes payment transactions and stores credit card numbers in a database. To reduce PCI DSS scope, they want to replace the card numbers with tokens. The tokens must be usable for transaction processing and the original card numbers must be retrievable for refunds. They also need to ensure that the tokenization solution is highly available and does not introduce a single point of failure. Which approach should they take?

Implement tokenization in-house using AWS KMS to encrypt the card numbers and store the tokens in the same database.

Use hashing with a salt to store the card numbers and use the hash as a token.

Use a third-party tokenization service that is PCI DSS compliant and provides a token vault.

Use AWS Secrets Manager to store the card numbers and generate tokens.

A data engineer needs to create a non-production dataset for testing. The dataset contains customer names and email addresses. The requirement is that the data must be irreversible so that even if the dataset is leaked, the original values cannot be recovered. Which masking technique should be used?

Tokenization using a token vault

Substitution with random values

Pseudonymization with a consistent mapping

Anonymization by removing or aggregating identifying fields

A company uses AWS KMS customer-managed keys to encrypt data in S3 and RDS. A security audit requires that keys be rotated automatically every year. The data engineer needs to implement a solution that minimizes operational overhead and ensures that existing encrypted data remains accessible. What should they do?

Use AWS-managed keys (aws/s3, aws/rds) and rely on AWS to rotate them.

Export the CMK and re-import it after rotation.

Enable automatic key rotation on the existing CMKs.

Manually create a new CMK each year and update the applications to use the new key.

AWSCertified Data Engineer - Associate

Domain 4Objective 3

Task 4.3: Ensure Data Encryption and Masking DEA-C01 Practice Questions (Page 1)

Part of the Content Domain 4: Data Security and Governance domain, which accounts for 18% of the DEA-C01 exam. AWS does not publish an official question count, but from its 130-minute exam (~50–85 total, ~9–15 in this domain), expect 2–3 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

8concepts

18%of the exam

Questions 1–5

1foundation · easy
Which AWS service can be used to create data masking recipes to transform and mask data for analytics?
Select an answer first
2expert · hard
A company processes payment transactions and stores credit card numbers in a database. To reduce PCI DSS scope, they want to replace the card numbers with tokens. The tokens must be usable for transaction processing and the original card numbers must be retrievable for refunds. They also need to ensure that the tokenization solution is highly available and does not introduce a single point of failure. Which approach should they take?
Select an answer first
3foundation · easy
A data engineer replaces customer names with unique identifiers in a dataset, but keeps a separate mapping table to link the identifiers back to the original names. Which technique is being used?
Select an answer first
4application · medium
A data engineer needs to create a non-production dataset for testing. The dataset contains customer names and email addresses. The requirement is that the data must be irreversible so that even if the dataset is leaked, the original values cannot be recovered. Which masking technique should be used?
Select an answer first
5expert · medium
A company uses AWS KMS customer-managed keys to encrypt data in S3 and RDS. A security audit requires that keys be rotated automatically every year. The data engineer needs to implement a solution that minimizes operational overhead and ensures that existing encrypted data remains accessible. What should they do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DEA-C01

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “DEA-C01” is a trademark of its owner, used for identification only.

Task 4.3: Ensure Data Encryption and Masking DEA-C01 Practice Questions (Page 1)

Questions 1–5

Which AWS service can be used to create data masking recipes to transform and mask data for analytics?

A data engineer replaces customer names with unique identifiers in a dataset, but keeps a separate mapping table to link the identifiers back to the original names. Which technique is being used?

Keep studying — Content Domain 4: Data Security and Governance