DEA-C01 Question 376
Select 3A company is using Amazon S3 to store sensitive customer data. To comply with security and compliance policies, they want to ensure that any unauthorized access attempts to the data are detected and properly logged. Additionally, they want to set up an alerting mechanism to notify their security team immediately when such events are detected. Which combination of AWS services should the company use to meet these requirements?
- A
Use Amazon Macie to classify and monitor sensitive data and detect anomalies.
- B
Enable AWS CloudTrail to log all API activity related to the S3 bucket.
- C
Set up Amazon CloudWatch Alarms to notify the security team of unauthorized access events.
- D
Use AWS Config to monitor configuration changes to the S3 bucket.
- E
Enable AWS Shield to protect against DDoS attacks on the S3 bucket.
Show answer and explanation
Correct answers: A, B, C
Explanation
To monitor and respond to unauthorized access attempts to sensitive data in Amazon S3, the company should use Amazon Macie to classify and monitor the data, AWS CloudTrail to log API activity, and Amazon CloudWatch Alarms to notify the security team of unauthorized access events. These services work together to ensure compliance, visibility, and quick response to security incidents.
- A. Correct.
Amazon Macie is specifically designed to help classify and monitor sensitive data in S3 buckets. It also detects anomalies, such as unusual access patterns, making it a key service for sensitive data monitoring.
- B. Correct.
AWS CloudTrail is essential for logging all API activity related to the S3 bucket, including access attempts, whether authorized or unauthorized. These logs can be analyzed to identify potential security issues.
- C. Correct.
Amazon CloudWatch Alarms can be used to create alerting mechanisms based on specific CloudTrail metrics, such as unauthorized access attempts, ensuring the security team is notified promptly.
- D. Incorrect.
AWS Config is useful for monitoring configuration changes to resources but does not provide direct insights into access patterns or unauthorized access attempts.
- E. Incorrect.
AWS Shield is used to protect against DDoS attacks but is not directly relevant for detecting unauthorized access to S3 bucket data.