SAA-C03 Design Secure Architectures Practice Question
A security team needs to identify and protect sensitive data, such as credit card numbers and passport IDs, that may be stored across hundreds of S3 buckets in multiple AWS accounts. Which service should they use to automate this discovery process?
⚠ Common exam trap
Candidates often select AWS Config or CloudTrail. While these audit configurations and API calls, they do not inspect the actual content of S3 objects for sensitive PII like Macie does.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon Macie to scan S3 buckets for personally identifiable information (PII).
Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect sensitive data in S3. It provides a centralized view of where sensitive data resides and how it is being accessed or moved, which is critical for compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon GuardDuty to monitor S3 data plane events for suspicious activity.
Why it's wrong here
Amazon GuardDuty is excellent for detecting threats like compromised credentials or unusual data access patterns in S3. However, it does not scan the actual content of the files to identify PII or sensitive data. Macie is specifically designed for content discovery, whereas GuardDuty focuses on behavior.
- ✓
Amazon Macie to scan S3 buckets for personally identifiable information (PII).
Why this is correct
Amazon Macie automatically discovers, classifies, and protects sensitive data at scale. It uses built-in sensitive data identifiers for common PII types and allows for custom identifiers. This makes it the ideal tool for organizations needing to audit their S3 storage for regulatory compliance and data privacy.
- ✗
AWS Glue to crawl S3 buckets and catalog the data types found in the files.
Why it's wrong here
AWS Glue is an ETL and data cataloging service used for preparing data for analytics. While it can crawl S3 buckets to determine schema and metadata, it is not a security tool and does not have the specialized machine learning models required to identify sensitive PII for security auditing purposes.
- ✗
Amazon Inspector to perform deep packet inspection on data uploaded to S3.
Why it's wrong here
Amazon Inspector focuses on scanning EC2 instances, Lambda functions, and ECR images for vulnerabilities and network exposure. It does not have the capability to scan S3 buckets or analyze the content of objects for sensitive information like credit card numbers, which is the primary function of Macie.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
This SAA-C03 question is part of Courseiva's 149-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.