CLF-C02 Security and Compliance Practice Question
A healthcare company stores patient records in Amazon S3 buckets across multiple accounts and needs to automatically discover and classify any objects containing personally identifiable information (PII) or protected health information (PHI). Which AWS service provides this capability?
⚠ Common exam trap
A common mix-up: candidates confuse Amazon Macie with Amazon GuardDuty, assuming both detect threats, but GuardDuty focuses on security threats and anomalies, not on data classification or sensitive content discovery in S3 objects.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon Macie
Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data stored in Amazon S3. It is specifically designed to identify personally identifiable information (PII) and protected health information (PHI) by analyzing object metadata and content, making it the correct choice for this healthcare compliance use case.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is a threat detection service that analyzes continuous streams of metadata from AWS CloudTrail events, VPC Flow Logs, and DNS logs to identify suspicious API activity, crypto-mining, and compromised instances. It does not inspect the content of S3 objects or scan for PII/PHI, because its focus is on detecting indicators of compromise and unauthorized behavior rather than classifying data stored within objects.
- ✗
AWS CloudTrail
Why it's wrong here
AWS CloudTrail provides governance, compliance, and audit for an AWS account by recording API activity, including actions taken against S3 buckets and objects such as PutObject, GetObject, and DeleteBucket. It logs who made the call, when, and from where, but it does not read the payload of S3 objects or perform any content analysis. CloudTrail's solely metadata-level logging means it cannot discover or classify PII or PHI within the data itself.
- ✗
Amazon Inspector
Why it's wrong here
Amazon Inspector is a vulnerability management service that assesses the security state of Amazon EC2 instances and container images in Amazon Elastic Container Registry (ECR). It scans workloads for software vulnerabilities, unintended network exposure, and deviations from best practices, but it has no capability to read or classify the contents of S3 objects. Therefore, Inspector cannot identify sensitive data like PII or PHI residing in S3 buckets.
- ✓
Amazon Macie
Why this is correct
Amazon Macie is a fully managed data security service that uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data stored in Amazon S3. It continuously monitors S3 buckets for personally identifiable information (PII) and protected health information (PHI), generating detailed findings when sensitive data is detected. These findings help security teams quickly remediate exposure, and Macie integrates with EventBridge for automated response workflows.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This CLF-C02 question is part of Courseiva's 993-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.