CLF-C02 Security and Compliance Practice Question
A company wants to identify sensitive data (such as PII and credit card numbers) stored in Amazon S3 buckets across their organization. Which AWS service automates this discovery?
⚠ Common exam trap
Many candidates confuse Amazon Macie with Amazon Inspector or GuardDuty because all three are security services, but only Macie is designed for content-aware data discovery and classification of sensitive data in S3.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon Macie
Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover, classify, and protect sensitive data stored in Amazon S3. It automatically identifies personally identifiable information (PII), credit card numbers, and other sensitive data types, making it the correct choice for this use case.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon Inspector
Why it's wrong here
Amazon Inspector is a vulnerability management service that continuously scans compute workloads, such as EC2 instances and Amazon ECR images, for software vulnerabilities like CVEs and unintended network exposure. It uses AWS Systems Manager and agent-based or agentless assessments to evaluate operating system and application-level risks, not object content in S3. Inspector cannot inspect the text or files stored in S3 buckets, so it cannot identify sensitive data such as PII or passwords.
- ✗
AWS Config
Why it's wrong here
AWS Config is a configuration and compliance auditing service that records resource configuration changes and evaluates them against AWS managed or custom rules. It can detect misconfigurations like an S3 bucket being public or lacking default encryption, but its focus is on resource metadata and infrastructure state, not on reading object payloads. Therefore, AWS Config cannot scan S3 object content to discover and classify sensitive data patterns.
- ✓
Amazon Macie
Why this is correct
Amazon Macie is a fully managed data security service that uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data stored in Amazon S3. It recognizes personally identifiable information, financial data, and credentials, and generates severity-rated findings with details about the affected bucket and object, including compliance context such as PCI-DSS. Macie also monitors bucket policies for potential data exposure and continuously evaluates new objects as they are written.
- ✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is a threat detection service that analyzes AWS log sources, including CloudTrail event logs, VPC flow logs, and DNS query logs, to identify malicious activity and unauthorized behavior. While GuardDuty can detect suspicious S3 access patterns, such as unusual downloads or anomalously large data exfiltration, it does not inspect the contents of S3 objects for sensitive data. Its purpose is to spot active threats based on behavioral telemetry, not to perform data classification or reveal whether data is sensitive.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.