CloudGuild · Blog · Cheat sheets · Lessons · Certifications
AWS Certified Solutions Architect - Associate Exam Question Walkthrough: Discovering Sensitive Data in S3
Explore a key exam question on AWS services for data classification. Understand why the correct answer is vital for AWS architects.
When preparing for the AWS Certified Solutions Architect - Associate exam, candidates often struggle with questions about service capabilities. Understanding the specific functions of AWS services is crucial, especially when they relate to security and data management.
The question
Which AWS service automatically discovers and classifies sensitive data such as PII stored in Amazon S3?
- A. Amazon GuardDuty
- B. Amazon Macie
- C. AWS Config
- D. AWS WAF
Think before you scroll
Before selecting an answer, consider the primary functions of each service. Reflect on which service is specifically designed for data discovery and classification, especially in the context of sensitive information.
The answer
The correct option is B. Amazon Macie. This service uses machine learning to automatically discover, classify, and protect sensitive data such as personally identifiable information (PII) stored in Amazon S3. Its specific focus on data classification makes it the clear choice for this question.
Why the other options lose
- A. Amazon GuardDuty: This service is focused on threat detection. It monitors for malicious activity and unauthorized behavior in AWS accounts and workloads but does not classify data.
- C. AWS Config: AWS Config is used to assess, audit, and evaluate the configurations of AWS resources. It tracks changes but does not classify or discover sensitive data.
- D. AWS WAF: AWS Web Application Firewall protects web applications from common web exploits. While it enhances security, it does not offer data discovery or classification functionalities.
The concept behind it
Understanding the purpose of AWS services is vital for architects. Each service has a specific role, whether it's monitoring, configuration management, or data classification. Knowing these roles helps you choose the right service for the right task, especially under exam conditions.
Exam trap to remember
Remember: Amazon Macie is the go-to service for discovering and classifying sensitive data in S3. Keep this in mind as you tackle similar questions about AWS services.