ExamPark
Course menuMLA-C02

Exams / MLA-C02 / Study guide / Masking and redacting data

Masking and redacting data: MLA-C02 study notes and practice questions

What to know about Masking and redacting data for the MLA-C02 exam, from the Data Preparation for ML and AI domain (28% of the exam guide), then 1 free question to test it. Part of the MLA-C02 study guide.

Last verified against current AWS documentation ·How we write our questions

What to know for the exam

These questions ask how to keep personal or regulated data out of models, logs and responses, with the least custom code.

Finding and removing sensitive data

Tool What it does
Amazon Comprehend Detects PII entities in text (names, addresses, account numbers) and returns their locations, or redacts them; use it in a pipeline before training
Amazon Macie Scans S3 buckets and reports which objects contain sensitive data; it doesn’t change the data
AWS Glue sensitive data detection Finds and masks or hashes PII columns in ETL jobs
Glue DataBrew Detects PII and applies masking, hashing or encryption in recipes
Amazon Transcribe Redacts PII in call transcripts
Bedrock Guardrails Blocks or masks PII in prompts and model responses at inference

Techniques

  • Redaction / masking: replace values with a placeholder or ****.
  • Tokenization or hashing: keep a consistent stand-in so joins still work.
  • Generalization: reduce precision (age bands, first three ZIP digits).
  • Synthetic data for testing and some training needs.
  • Drop columns the model doesn’t need, which is the simplest control.

Protecting the data you keep

  • Encrypt with customer managed KMS keys and restrict buckets with policies.
  • Keep raw data in a separate, tightly controlled account or prefix.
  • Turn off or filter model invocation logging fields that could capture sensitive prompts, or encrypt and restrict the log destination.
  • Bedrock doesn’t use your prompts or fine-tuning data to train the base models.

Choosing

  • “Find which buckets contain PII”: Macie.
  • “Remove names from text before fine-tuning”: Comprehend PII redaction.
  • “Mask account numbers in chatbot answers”: Guardrails sensitive information filters.

Common traps

  • Macie to redact data. It reports; it doesn’t change objects.
  • Trusting a system prompt to keep PII out of answers.
  • Logging full prompts with personal data to an open bucket.

Try the 1 practice question

Practice Masking and redacting dataTake the free practice exam

Question 1

Medium · choose 2 ·Link to this question (question 1)

A regional bank records customer service calls and turns the transcripts into text for a fine-tuning dataset. The transcripts contain names, account numbers and home addresses that must not reach the training data or the model.

The team needs a pipeline that finds this personal information in each transcript, replaces it with placeholders, and stores the redacted text where only the data team can read it. The bank's security policy requires encryption at rest with a customer managed key.

Which TWO actions meet these requirements? (Choose two.)

Choose two answers.

  1. A. Run Amazon Macie on the transcript bucket and rely on its findings report to decide which transcripts to delete.
  2. B. Call the Amazon Comprehend PII detection API from the processing step for each transcript, and replace each detected entity with its type label before writing the text.
  3. C. Store the redacted transcripts in an S3 bucket encrypted with the AWS managed key, which is the default for all buckets.
  4. D. Store the redacted transcripts in an S3 bucket encrypted with an AWS KMS customer managed key, and restrict the bucket policy to the data team's role.
  5. E. Use Amazon Rekognition to detect faces and names in the transcript images and blur them before training.
Show the answer and explanation

Answers: B, D

  • A. Wrong: Macie discovers sensitive data in S3 buckets and reports findings, but it does not redact the text inside each transcript. Deleting whole transcripts would throw away the useful conversation.
  • B. Right: Correct. Amazon Comprehend detects personally identifiable information in text and returns entity offsets, which the pipeline can use to replace the values with placeholders. The redacted text is then safe to use for training. Learn more: Personally identifiable information (PII) in Amazon Comprehend (opens in a new tab)
  • C. Wrong: The stem asks for a customer managed key. The AWS managed key is a valid encryption option, but it does not meet this policy.
  • D. Right: Correct. A customer managed key meets the encryption requirement, and a bucket policy limited to the data team restricts who can read the redacted text. Together with the redaction step, both parts of the policy are covered. Learn more: Protecting data using server-side encryption with KMS keys (opens in a new tab)
  • E. Wrong: Rekognition analyzes images and video, while these transcripts are text. The option does not address the text fields the stem describes.

Explanation

Amazon Comprehend finds personal information in text, so the pipeline can replace it before training. A customer managed KMS key and a restrictive bucket policy satisfy the encryption and access requirements. Macie reports sensitive data without redacting it, and Rekognition works on images.

Study

Want more on Masking and redacting data? The 5 full-length practice sets have 7 more Masking and redacting data questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets

Study Masking and redacting data

More Data Preparation for ML and AI topics