Q86 — AWS SAA-C03 Ch.17

Question 86 of 89 | ← Chapter 17

Q1386. A company manages millions of documents in hundreds of Amazon S3 buckets in multiple AWS Regions. The company must determine whether any of the S3 buckets contain personally identifiable information (PII).Which solution will meet this requirement with the LEAST operational overhead?

Correct Answer: C. Use Amazon Macie to detect PII in the S3 buckets.

Explanation

Let's analyze each option to determine the solution with the least operational overhead for detecting personally identifiable information (PII) in millions of documents across hundreds of Amazon S3 buckets in multiple AWS Regions:Option A: Use Amazon Detective to detect PII in the S3 buckets Amazon Detective is a security service that helps analyze and investigate security findings from AWS security services such as Amazon GuardDuty, AWS Security Hub, and Amazon VPC Flow Logs. It is primarily focused on security investigations, threat detection, and understanding the root cause of security incidents. It is not designed specifically for detecting PII in S3 buckets. So, this option is not suitable for the given requirement.Option B: Use AWS Trusted Advisor to generate PII notifications AWS Trusted Advisor provides real - time guidance to help optimize AWS resources, reduce costs, improve security, and enhance performance. However, it does not have a built - in capability to detect PII in S3 buckets. Its main functions include checking for security best practices, cost - optimization opportunities, and service - level issues, but not PII detection. Therefore, this option does not meet the requirement.Option C: Use Amazon Macie to detect PII in the S3 buckets Amazon Macie is a fully - managed data security and data privacy service that uses machine learning and pattern matching to discover, classify, and protect sensitive data in AWS. It can automatically scan S3 buckets for PII such as names, addresses, credit card numbers, and other personally identifiable information. Macie provides a centralized dashboard to view and manage the findings, and it can also send alerts when PII is detected. Since it is a fully - managed service, it requires minimal operational overhead. The company can simply configure Macie to scan the relevant S3 buckets, and it will take care of the detection process. This option is well - suited for the given requirement.Option D: Use AWS Lambda functions to review each file in the S3 buckets to identify PII While it is possible to use AWS Lambda functions to scan the files in S3 buckets for PII, this approach has significant operational overhead. The company would need to write custom code to implement the PII detection logic, which can be complex and time - consuming. Additionally, managing the Lambda functions, handling errors, and scaling the solution to handle millions of documents across hundreds of buckets would require a lot of effort. This option is not as efficient as using a fully - managed service like Amazon Macie.Based on the above analysis, the solution that will meet the requirement with the least operational overhead is to use Amazon Macie to detect PII in the S3 buckets.So the answer is C.