Q44 — AWS SAA-C03 Ch.15

Question 44 of 100 | ← Chapter 15

Q1144. A company recently migrated a large amount of research data to an Amazon S3 bucket.The company needs an automated solution to identify sensitive data in the bucket. A security team also needs to monitor access patterns for the data 24 hours a day,7 days a week to identify suspicious activities or evidence of tampering with security controls.Which solution will meet these requirements?

Correct Answer: B. Enable Amazon Macie and Amazon GuardDuty on the account. Grant the security team access to Macie and GuardDuty. Review the findings with the security team.

Explanation

Let's analyze the requirements and the options to determine the best solution for identifying sensitive data in an Amazon S3 bucket and monitoring access patterns for suspicious activities.Key Requirements:Identify Sensitive Data in S3: The solution must automatically scan the S3 bucket for sensitive data (e.g., PII, financial data).Monitor Access Patterns 24/7: The solution must continuously monitor access to the S3 bucket to detect suspicious activities or tampering with security controls. Security Team Access: The security team needs access to the findings/reports.Key AWS Services:Amazon Macie: A fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect sensitive data in AWS (e.g., S3). It can identify PII, financial data, etc.Amazon GuardDuty: A threat detection service that continuously monitors for malicious activity and unauthorized behavior (e.g., unusual API calls, compromised credentials). AWS CloudTrail: Logs API calls and actions in AWS, useful for audit trails but not specialized for sensitive data discovery or real-time threat detection.Amazon S3 Inventory: Provides a CSV, ORC, or Parquet output file listing objects and their metadata in an S3 bucket. Useful for compliance but not for sensitive data discovery or real-time monitoring. Amazon Athena + QuickSight: Can query S3 data (e.g., inventory reports) but does not automatically identify sensitive data or monitor access patterns.IAM Access Advisor: Shows service access for IAM users/roles but does not monitor for suspicious activity or tampering.Analysis of Options:Option A:AWS CloudTrail Reporting: Logs API calls but does not automatically identify sensitive data or monitor for suspicious activity in real time.Amazon S3 Inventory Report: Lists objects but does not identify sensitive data (unless manually processed).Grant Security Team Read-Only Access to CloudTrail Reports: This does not meet the requirement for automated sensitive data discovery or real-time monitoring. Conclusion: Incorrect because it does not provide automated sensitive data discovery or real-time threat detection.Option B:Enable Amazon Macie: Correct. Macie automatically scans S3 buckets for sensitive data (e.g., PII, financial data) and alerts the security team.Enable Amazon GuardDuty: Correct. GuardDuty monitors for suspicious activities (e.g., unusual API calls, compromised credentials) and alerts the security team.Grant Security Team Access to Macie and GuardDuty: This allows the security team to review findings. Conclusion: This is the best option because it meets both requirements: sensitive data discovery (Macie) and real-time monitoring (GuardDuty).Option C:Amazon S3 Inventory Report: Lists objects but does not identify sensitive data (unless manually processed).Amazon Athena + QuickSight: Can query inventory data but does not automatically identify sensitive data or monitor for suspicious activity.Create a Dashboard for the Security Team: This is not automated sensitive data discovery or real-time monitoring.Conclusion: Incorrect because it does not provide automated sensitive data discovery or real-time threat detection.Option D:AWS IAM Access Advisor: Shows service access but does not monitor for suspicious activity or tampering in real time.Create a Dashboard for the Security Team: This does not provide automated sensitive data discovery or real-time monitoring.Amazon S3 Inventory Report: Lists objects but does not identify sensitive data (unless manually processed).Conclusion: Incorrect because it does not meet the requirements for sensitive data discovery or real-time threat detection.Why Not Other Options?A: CloudTrail and S3 Inventory do not provide automated sensitive data discovery or real-time monitoring.C: Athena and QuickSight do not automatically identify sensitive data or monitor for suspicious activity.D: IAM Access Advisor and S3 Inventory do not provide automated sensitive data discovery or real-time monitoring.Final Answer:B is the correct solution. Enabling Amazon Macie will automatically identify sensitive data in the S3 bucket, and enabling Amazon GuardDuty will monitor access patterns 24/7 for suspicious activities. Granting the security team access to both services allows them to review the findings.答案:B