A Data Engineer is building a model that uses customer credit card details. How can they ensure the data remains encrypted and the card numbers are protected?

The correct answer ensures comprehensive data protection. AWS Key Management Service (KMS) provides robust encryption for data at rest in Amazon S3 (where data is typically stored) and within Amazon SageMaker (where models are trained and hosted). Redacting or masking credit card numbers using AWS Glue is a crucial step for preventing sensitive data exposure during processing and analysis, adhering to compliance requirements like PCI DSS. Incorrect options: Encrypting with a custom algorithm is generally less secure and harder to manage than AWS KMS. SageMaker DeepAR is for forecasting, not data randomization. Relying solely on an IAM policy for S3 encryption is insufficient; KMS provides the actual encryption keys. Kinesis is for real-time data streaming, not for dropping and inserting fake numbers in a dataset. Configuring SageMaker launch settings to encrypt after copying is too late; data should be encrypted at rest from the start. SageMaker PCA is for dimensionality reduction, not shortening credit card numbers.