SCS-C02 Question 479
Select 2Your organization stores sensitive customer data in S3 buckets across multiple AWS accounts. To ensure compliance and proper data classification, you need to identify PII (Personally Identifiable Information) and categorize the data into different sensitivity levels. Which AWS services and features can you use to automate this process?
- A
Amazon Macie to automatically discover and classify sensitive data stored in S3 buckets
- B
AWS Config to automatically classify sensitive data in S3 buckets
- C
AWS Lambda to write custom scripts for data classification in S3 buckets
- D
Amazon S3 Object Lock to classify objects based on sensitivity levels
- E
AWS Glue Data Catalog to support metadata classification for the data in S3 buckets
Show answer and explanation
Correct answers: A, E
Explanation
Amazon Macie is the primary AWS service for automated sensitive data discovery and classification, making it ideal for identifying PII in S3 buckets. The AWS Glue Data Catalog complements this by allowing metadata tagging and management, providing a way to organize and classify data further. Together, these tools automate and streamline the data classification process needed for compliance and governance.
- A. Correct.
Amazon Macie is specifically designed to discover and classify sensitive data such as PII stored in S3 buckets. It uses machine learning to automate data classification.
- B. Incorrect.
AWS Config is a tool for assessing and auditing resource configurations. While it can track configuration changes, it is not used for classifying sensitive data in S3 buckets.
- C. Incorrect.
AWS Lambda can be used for custom workflows but does not inherently provide a solution for automated sensitive data classification. This would require extensive manual effort and coding.
- D. Incorrect.
Amazon S3 Object Lock is used to enforce retention policies and prevent object deletion, but it does not provide data classification capabilities.
- E. Correct.
AWS Glue Data Catalog helps manage metadata for data in S3 buckets, including tagging and classification, which can support sensitivity level classification.