DOP-C02 practice question: Encryption, KMS, ACM and Macie (1 of 2)
Security and Compliance A free question from our original DOP-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
An insurance firm stores claim attachments in about 200 Amazon S3 buckets across its member accounts. Some attachments were uploaded with scanned identity documents and medical notes, but nobody has an inventory of which buckets hold this sensitive data.
The privacy office wants every bucket checked for sensitive data, including buckets created later, with results visible to a central security account. The scanning must not require the firm to build and run its own scanning system.
Which approach meets these requirements with the LEAST operational overhead?
Choose one answer.
AA. Enable Macie automated sensitive data discovery from the organization's Macie administrator account, so that buckets in every member account, including new ones, are sampled.
BB. Write a Lambda function that lists every bucket each night, downloads a sample of objects, and searches them for patterns with a regular expression that the team maintains.
CC. Turn on S3 server access logging for all buckets, and review the access logs to see which buckets are used most often, so that the privacy office can choose which buckets to check.
DD. Enable default encryption with an AWS KMS key on every bucket, which means sensitive data is encrypted and the privacy office no longer needs to find it.
Show the answer and explanation
Answer: A
A. Right: Correct. Automated sensitive data discovery continually evaluates the bucket inventory, including buckets that member accounts own, and samples objects for sensitive data. The Macie administrator sees the results centrally without a custom scanner. Learn more: Performing automated sensitive data discovery (opens in a new tab)
B. Wrong: The team would build and run a scanner, keep its patterns current and handle its own errors and costs. The requirement was to avoid running its own scanning system.
C. Wrong: Access logs show who requested objects, not what the objects contain. They do not identify sensitive data in the buckets.
Amazon Macie automated sensitive data discovery, managed from the organization's Macie administrator account, continually evaluates the bucket inventory and samples objects in member buckets, including buckets created later. The results are central, and no scanner needs to be built. Custom scanners, access logs and encryption each miss either the inventory or the managed-service requirement.
Want more on Encryption, KMS, ACM and Macie? The 5 full-length practice sets have 10 more Encryption, KMS, ACM and Macie questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →