SCS-C02 Question 477
Select 2Your organization stores sensitive data in Amazon S3 buckets and needs to ensure that data classification is applied to comply with regulatory requirements. Which AWS services can help you classify and manage data sensitivity in your S3 buckets?
- A
Amazon Macie
- B
AWS Config
- C
AWS Key Management Service (KMS)
- D
Amazon Inspector
- E
AWS CloudTrail
Show answer and explanation
Correct answers: A, B
Explanation
Amazon Macie is specifically designed for discovering and classifying sensitive data in S3 buckets, making it a critical tool for data classification. AWS Config complements this by ensuring that the configurations of S3 buckets adhere to compliance and governance policies, including data sensitivity requirements. While other options like KMS, Inspector, and CloudTrail provide critical security functionalities, they do not directly address data classification.
- A. Correct.
Amazon Macie is a fully managed service that uses machine learning to automatically discover, classify, and protect sensitive data stored in Amazon S3. It is specifically designed for data classification tasks.
- B. Correct.
AWS Config can be used to assess, audit, and evaluate the configurations of your AWS resources, including verifying compliance with data classification policies and rules.
- C. Incorrect.
AWS Key Management Service (KMS) is used for encryption key management and does not directly classify data. However, it helps secure sensitive data but isn’t involved in discovering or classifying it.
- D. Incorrect.
Amazon Inspector is a tool for vulnerability management and helps assess security issues in your EC2 instances and container images. It is not related to data classification in S3.
- E. Incorrect.
AWS CloudTrail is a service for logging and monitoring API activity in your account. While it provides visibility into actions performed, it does not classify data stored in S3.