SCS-C03 Data Protection Practice Question
An organization is using Amazon Macie to protect sensitive data in S3. They want to ensure they are alerted to the presence of PII across all buckets. Which TWO actions are required to configure Macie to identify sensitive data effectively?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a sensitive data discovery job to scan the S3 buckets, specifying the depth and frequency of the analysis.
Amazon Macie requires both a discovery job and the proper permissions to analyze data. Discovery jobs allow you to define the scope and frequency of the scan, while the service-linked role ensures Macie has the necessary access to read the objects in your S3 buckets for analysis and classification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a sensitive data discovery job to scan the S3 buckets, specifying the depth and frequency of the analysis.
Why this is correct
A discovery job is the mechanism Macie uses to inspect objects in S3. You can configure it to run once or on a recurring basis, and you can define which buckets to include. This job performs the actual analysis of the data against managed or custom data identifiers.
- ✓
Enable the Macie service-linked role in IAM to allow the service to access and analyze objects in the S3 buckets.
Why this is correct
Macie uses a service-linked role to grant it the permissions needed to call other AWS services on your behalf. This role is essential for Macie to retrieve objects from S3 for inspection. Without these permissions, Macie cannot perform the analysis required to identify PII or other sensitive information.
- ✗
Install the Macie agent on all EC2 instances that write data to the S3 buckets to classify data in real-time.
Why it's wrong here
Amazon Macie does not use agents. It is a service-side tool that analyzes data directly within S3 buckets. Classification happens on the stored objects, not during the data transmission or on the compute instances themselves, making it a non-intrusive way to manage data security and compliance across the account.
- ✗
Configure S3 Event Notifications to send every new object to a Lambda function that calls the Macie 'ScanObject' API.
Why it's wrong here
There is no 'ScanObject' API for Macie that is intended to be called on a per-object basis via Lambda. Macie is designed to perform discovery through managed jobs that scan the bucket contents. While you can automate job creation, the per-object trigger via Lambda is not the standard or efficient way to use Macie.
- ✗
Enable S3 Object Lock on all buckets to allow Macie to generate findings without the risk of data being deleted during a scan.
Why it's wrong here
S3 Object Lock is a data protection feature for immutability, but it is not a prerequisite for Amazon Macie. Macie can scan objects regardless of whether Object Lock is enabled. While Object Lock helps with data retention, it does not impact Macie's ability to identify sensitive data within those objects.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
This SCS-C03 question is part of Courseiva's 99-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.