SOA-C02 Question 204
Select 3Your company has recently implemented a data classification policy to categorize data as 'Confidential,' 'Internal,' and 'Public.' You are tasked with enforcing this classification policy for data stored in Amazon S3. Which combination of actions should you take to ensure the classification is consistently applied and monitored?
- A
Use S3 bucket tags to apply classification labels like 'Confidential,' 'Internal,' and 'Public' to each bucket.
- B
Implement S3 Object Tags to apply classification labels on individual objects within the buckets.
- C
Set up an Amazon Macie job to automatically discover and classify sensitive data in your S3 buckets.
- D
Use IAM policies to restrict access to buckets based on classification labels using condition keys for tags.
- E
Enable S3 Versioning to track changes to objects and ensure data classification is preserved.
Show answer and explanation
Correct answers: B, C, D
Explanation
To enforce a data classification scheme in S3, you should apply classification labels at the object level using S3 Object Tags. Amazon Macie can help discover and classify sensitive data, while IAM policies can enforce access control based on those classification tags. These methods together ensure that the classification policy is consistently applied and monitored.
- A. Incorrect.
Using S3 bucket tags for data classification is not specific enough, as classification often needs to be applied at the object level, not just the bucket level.
- B. Correct.
S3 Object Tags allow you to label individual objects with classifications like 'Confidential,' making it a suitable option for enforcing data classification schemes.
- C. Correct.
Amazon Macie can automatically discover and classify sensitive data, which helps ensure compliance with your data classification policy.
- D. Correct.
IAM policies can leverage tags in condition keys to restrict or allow access based on data classification labels, enforcing the policy effectively.
- E. Incorrect.
While S3 Versioning is useful for data recovery and tracking changes, it does not directly enforce or monitor data classification schemes.