You work as a machine learning specialist for a banking firm working in the credit card processing division. Your team builds a credit limit authorization model that needs to use a dataset containing personally identifiable information (PII), such as customer credit card information. How will your team ensure the PII data remains encrypted and the credit card information is not compromised?

Answer options:

A.Encrypt the data on S3 and SageMaker using KMS, obfuscate the credit card information from the customer data with a Glue ETL job.
B.Encrypt the data using a SageMaker lifecycle configuration once the data is copied to the SageMaker instance in a VPC. Use the principal component analysis (PCA) algorithm to reduce the dimensionality of the credit card numbers.
C.Encrypt the data on the S3 bucket and Kinesis using an IAM policy, remove the customer credit card numbers and insert fabricated credit card numbers using a Glue ETL job.
D.Encrypt the data using a custom-coded encryption algorithm and store the data on a SageMaker instance in a VPC. Fabricate new credit card numbers using the SageMaker DeepAR built-in algorithm, replacing the customer credit card numbers.

Correct Answer: A
Option A is correct. Using KMS to encrypt the data is the best choice of the options given. KMS is a managed service and encrypts your data using the same key for S3 and SageMaker. Also, using a Glue ETL job, you can remove the credit card information from the dataset by dropping that column from the dataset in your ETL job.
Option B is incorrect. A lifecycle configuration is a script that runs when your notebook instance is created. Trying to use a lifecycle configuration to encrypt data is not an option that would work. Also, the Principal Component Analysis algorithm reduces the dimensionality of a dataset. One would not use PCA to obfuscate PII data.
Option C is incorrect. You can’t encrypt data with an IAM policy alone. You need to combine your IAM policies with a service like KMS.
Option D is incorrect. This option is incorrect because writing your own encryption algorithm is counterproductive when you have a managed service in AWS, KMS, that will encrypt your data to the highest industry standards. Also, using a DeepAR algorithm to randomize the PII data further complicates this option.
References:
Please see the AWS Glue developer guide titled Built-In Transforms (https://docs.aws.amazon.com/glue/latest/dg/built-in-transforms.html),
The Amazon SageMaker developer guide titled Principal Component Analysis (PCA) Algorithm (https://docs.aws.amazon.com/sagemaker/latest/dg/pca.html),
The Amazon SageMaker developer guide titled Customize a Notebook Instance Using a Lifecycle Configuration Script (https://docs.aws.amazon.com/sagemaker/latest/dg/notebook-lifecycle-config.html),
The AWS Identity and Access Management user guide titled Data protection in AWS Identity and Access Management (https://docs.aws.amazon.com/IAM/latest/UserGuide/data-protection.html)