SAP-C02 Question 407
Select 3A financial services company stores sensitive customer data in Amazon S3 and must comply with GDPR and PCI DSS regulations. They need a solution to enforce data retention policies, identify sensitive data automatically, and ensure compliance with data regulatory requirements. Which combination of services and features should the company use to meet their requirements?
- A
Enable S3 Object Lock with Compliance mode and configure a retention period.
- B
Use Amazon Macie to classify and identify sensitive data within S3 buckets.
- C
Use S3 Cross-Region Replication to store data in multiple regions for redundancy.
- D
Enable AWS Config rules to monitor and enforce encryption and access control policies on S3 buckets.
- E
Use Amazon GuardDuty to continuously monitor for unauthorized access to S3 buckets.
Show answer and explanation
Correct answers: A, B, D
Explanation
To meet the company's requirements, a combination of S3 Object Lock, Amazon Macie, and AWS Config is needed. S3 Object Lock ensures immutable data retention, Amazon Macie identifies and classifies sensitive data, and AWS Config enforces compliance with encryption and access control policies. These services collectively address data retention, data sensitivity, and data regulatory requirements as required by GDPR and PCI DSS.
- A. Correct.
Enabling S3 Object Lock in Compliance mode with a retention period ensures that data cannot be deleted or overwritten during the retention period, which is critical for meeting data retention requirements under regulations like GDPR and PCI DSS.
- B. Correct.
Amazon Macie helps classify and identify sensitive data, such as personally identifiable information (PII), in S3 buckets. This is essential for understanding data sensitivity and maintaining compliance with regulations.
- C. Incorrect.
S3 Cross-Region Replication is useful for data redundancy and disaster recovery but does not enforce data retention policies or assist in identifying sensitive data, so it does not directly address the requirements in the scenario.
- D. Correct.
AWS Config rules can monitor S3 buckets for compliance with encryption and access control policies, ensuring that data is protected and regulatory requirements are met.
- E. Incorrect.
Amazon GuardDuty is a threat detection service that monitors for unauthorized access and potential security issues, but it does not enforce data retention policies or classify sensitive data.