SAA-C03 Design Secure Architectures Practice Question
A data analytics company stores massive amounts of data in Amazon S3. They need a way to automatically identify and flag sensitive data, such as Personally Identifiable Information (PII) or financial records, to ensure it is not being mishandled. Which AWS service is designed for this task?
⚠ Common exam trap
Candidates often confuse Amazon Macie with AWS GuardDuty or IAM Access Analyzer, losing track of Macie's specific focus on S3 data discovery.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon Macie
Amazon Macie is a fully managed data security and data privacy service. It uses machine learning and pattern matching to automatically discover and protect sensitive data in Amazon S3. Macie provides a dashboard and findings that alert the security team to PII, helping them maintain data privacy compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon GuardDuty
Why it's wrong here
GuardDuty is a threat detection service that monitors for malicious behavior and unauthorized access to your AWS account. It does not inspect the content of objects stored in S3 to identify sensitive data or PII, making it unsuitable for data discovery and classification tasks.
- ✓
Amazon Macie
Why this is correct
Amazon Macie is specifically built to discover and protect sensitive data at scale. It scans S3 buckets and identifies data types like credit card numbers, social security numbers, and API keys. This automation helps organizations understand their data exposure and implement appropriate security controls efficiently.
- ✗
AWS Glue
Why it's wrong here
AWS Glue is a fully managed extract, transform, and load (ETL) service that makes it simple to prepare and load data for analytics. While it can crawl S3 data to build a data catalog, it is not a security service designed for PII detection or sensitive data protection.
- ✗
Amazon Inspector
Why it's wrong here
Amazon Inspector is a vulnerability management service that scans workloads for software vulnerabilities and unintended network exposure. It focuses on EC2 instances, containers, and Lambda functions, but it does not have the capability to analyze and classify data stored within Amazon S3 buckets.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
One of 149 original SAA-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.