A company stores millions of objects in Amazon S3 and wants to automatically discover which objects contain sensitive data, such as national ID numbers or credit card numbers, using machine learning and pattern matching, and to be alerted if a bucket holding that data becomes publicly accessible. Which service fits this need?
- Amazon Inspector, which scans workloads for known software vulnerabilities and unintended network reachability
- Amazon Macie, which uses machine learning and pattern matching to discover sensitive data such as personally identifiable information in S3 objects and monitors buckets for public-access and other security risks
- AWS Config, which evaluates resource configurations against compliance rules
- Amazon GuardDuty, which detects malicious or anomalous account and network activity from log analysis
Why B? And why not the others?
Correct answer: B. Amazon Macie, which uses machine learning and pattern matching to discover sensitive data such as personally identifiable information in S3 objects and monitors buckets for public-access and other security risks
Amazon Macie is a data-security service that uses machine learning together with pattern matching to discover sensitive data such as personally identifiable information and financial information stored in S3 objects, while also maintaining an inventory of buckets and generating findings when a bucket's security posture changes, such as becoming publicly accessible. The option describing vulnerability and network-reachability scanning is wrong because that inspects workloads for known software flaws, not the content of stored objects for sensitive data. The option describing configuration evaluation against compliance rules is wrong because that checks whether a resource's settings match a desired configuration, not whether the data inside an object is sensitive. The option describing anomaly detection from log analysis is wrong because that identifies suspicious behavioral patterns in account and network activity rather than scanning object content for sensitive data types.
Source: Amazon Macie documentation: What is Amazon Macie? (https://docs.aws.amazon.com/macie/latest/user/what-is-macie.html)