Q8 — AWS SAA-C03 Ch.15

Question 8 of 100 | ← Chapter 15

Q1108. A company has an organization in AWS Organizations that has all features enabled. The company has multiple Amazon S3 buckets in multiple AWS Regions around the world. The S3 buckets contain sensitive data.The company needs to ensure that no personally identifiable information (PII) is stored in the S3 buckets. The company also needs a scalable solution to identify PII.Which solution will meet these requirements?

• A. In the Organizations management account, configure an Amazon Macie administrator IAM user as the delegated administrator for the global organization.Use the Macie administrator user to configure Macie settings to scan for PII. ✓
• B. For each Region in the Organizations management account, designate a delegated Amazon Macie administrator account. In the Macie administrator account, add all accounts in the organization. Use the Macie administrator account to enable Macie. Configure automated sensitive data discovery for all accounts in the organization.
• C. For each Region in the Organizations management account, configure a service control policy (SCP) to identify PII. Apply the SCP to the organization root.
• D. In the Organizations management account, configure AWS Lambda functions to scan for PII in each Region.

Correct Answer: A. In the Organizations management account, configure an Amazon Macie administrator IAM user as the delegated administrator for the global organization.Use the Macie administrator user to configure Macie settings to scan for PII.

Explanation

To meet the company's requirements of ensuring no personally identifiable information (PII) is stored in their Amazon S3 buckets across multiple AWS Regions and needing a scalable solution to identify PII, the best solution is:A. In the Organizations management account, configure an Amazon Macie administrator IAM user as the delegated administrator for the global organization. Use the Macie administrator user to configure Macie settings to scan for PII.Analysis:Organization Setup:The company has an AWS Organizations setup with all features enabled. They have multiple S3 buckets in various AWS Regions containing sensitive data.Requirements:Identify and ensure no PII is stored in S3 buckets.Need a scalable solution to identify PII.Evaluation of Options:A. Amazon Macie with Delegated Administrator:Amazon Macie is a fully managed service that uses machine learning and pattern matching to discover and protect sensitive data in AWS.By configuring an IAM user as the delegated administrator for Macie in the Organizations management account, Macie can be enabled and configured once to scan for PII across all accounts in the organization. This provides a centralized view and management of Macie settings, ensuring scalability and efficiency. B. Designate a Macie Administrator Account for Each Region:This approach would require setting up multiple Macie administrator accounts, one for each Region. It adds complexity and overhead, as each Region would need separate management and configuration.It does not provide a centralized, scalable solution.C. Use Service Control Policies (SCPs) to Identify PII:SCPs are used to enforce permissions across accounts in an AWS Organizations setup. They do not provide a mechanism to identify or scan for PII within S3 buckets.Therefore, this option does not meet the requirements.D. Configure AWS Lambda Functions to Scan for PII:While Lambda functions can be used to create custom scanning solutions, they would need to be individually configured and managed for each Region and bucket. This lacks the scalability and ease of management provided by a fully managed service like Amazon Macie.Additionally, developing and maintaining a custom scanning solution would likely require more operational overhead.Conclusion:Option A is the most suitable solution. By configuring Amazon Macie with a delegated administrator in the Organizations management account, the company can ensure a scalable, centralized, and efficient way to identify and manage PII across all their S3 buckets in multiple Regions. This approach minimizes operational overhead and meets the company's requirements for identifying and ensuring no PII is stored in their S3 buckets.