Exams / SAA-C03 / Threat detection and data discovery / Question 2
SAA-C03 practice question: Threat detection and data discovery (2 of 2)
Design Secure Architectures A free question from our original SAA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A healthcare company stores files in about 600 Amazon S3 buckets spread across 25 member accounts in AWS Organizations. The files include CSV exports, PDFs and JSON logs. Before a privacy audit, the compliance team must find which buckets hold personal data such as names, addresses and payment card numbers, and must keep checking as teams create new buckets. The team has no data engineers. Which solution meets these requirements with the LEAST operational effort?
Choose one answer.
- AA. Turn on Amazon GuardDuty S3 Protection for the organisation, and review the findings that flag unusual access to buckets holding customer files.
- BB. Designate a Macie administrator account for the organisation, and turn on automated sensitive data discovery for all member accounts.
- CC. Catalogue every bucket with AWS Glue crawlers, then run Amazon Athena queries with regular expressions that match names, addresses and card numbers.
- DD. Run Amazon Comprehend PII detection jobs against the files in each bucket, and collect the results in a central bucket for review.
Show the answer and explanation
Answer: B
- A. Wrong: GuardDuty S3 Protection watches object-level API activity for signs of threats such as data exfiltration. It does not look inside objects, so it cannot say which buckets contain personal data. Macie inspects object contents. Learn more: GuardDuty S3 Protection (opens in a new tab)
- B. Right: Correct. Amazon Macie uses managed data identifiers to find personal and financial data in many file types. With an organisation-wide administrator and automated discovery, it keeps sampling objects across all buckets, including new ones, with no code to write. Learn more: Performing automated sensitive data discovery (opens in a new tab)
- C. Wrong: Athena queries structured data, so the PDFs would be missed, and the team would have to write and maintain the patterns and crawlers for 600 buckets. That is a lot of data engineering for a team that has none. Macie does this as a managed service. Learn more: What is Amazon Athena? (opens in a new tab)
- D. Wrong: Comprehend can detect personal data in English or Spanish text, but the team would have to start, track and repeat jobs for every bucket and account, including new ones. That is ongoing custom work. Macie's automated discovery covers all buckets on its own. Learn more: Detecting PII entities (opens in a new tab)
Explanation
Amazon Macie discovers sensitive data in Amazon S3. Integrated with AWS Organizations, a Macie administrator can enable it for member accounts, and automated sensitive data discovery continually samples objects across the bucket inventory. GuardDuty watches access rather than contents, and Athena or Comprehend would need custom pipelines.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.