SAA-C03 Q201 · Security

Question

A company recently migrated a large amount of research data to an Amazon S3 bucket. The company needs an automated solution to identify sensitive data in the bucket. A security team also needs to monitor access patterns for the data 24 hours a day, 7 days a week to identify suspicious activities or evidence of tampering with security controls. Which solution will meet these requirements?

Accepted Answer

This question has two distinct requirements:

**Requirement 1: Automated identification of sensitive data in S3**
→ **Amazon Macie** is purpose-built for this. Macie uses machine learning and pattern matching to automatically discover and classify sensitive data (PII, financial data, credentials, etc.) stored in S3 buckets. It scans objects and produces detailed findings about what sensitive data exists and where.

**Requirement 2: 24/7 monitoring of access patterns for suspicious activity**
→ **Amazon GuardDuty** (specifically its S3 Protection feature) continuously monitors CloudTrail S3 data events and CloudTrail management events to detect suspicious activities. It identifies threats like unusual API calls, access from anomalous locations, attempts to disable logging (tampering with se

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips