SCS-C02 Threat Detection and Incident Response Practice Question

A company has a requirement to detect and alert on S3 objects that contain personally identifiable information (PII) being shared publicly. Which AWS service should be used?

⚠ Common exam trap

Watch out — candidates often confuse Amazon GuardDuty's threat detection capabilities (which focus on API calls and network behavior) with Macie's data classification and content inspection, leading them to select GuardDuty when the requirement specifically involves detecting PII in S3 objects.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Amazon Macie

Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover, classify, and protect sensitive data such as personally identifiable information (PII) stored in Amazon S3. It can automatically generate alerts when S3 objects containing PII are made publicly accessible, meeting the requirement to detect and alert on such events.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Amazon CloudWatch
Why it's wrong here
Amazon CloudWatch focuses on operational metrics, logs, and events from AWS resources, but it does not inspect the contents of S3 objects or classify data. You could create a custom solution that sends S3 event notifications to CloudWatch Logs, but CloudWatch itself lacks native data-discovery or sensitive-data-detection capabilities. Therefore, it cannot directly meet the requirement to detect and alert on S3 object content.
✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is a threat-detection service that analyzes AWS CloudTrail, VPC Flow Logs, and DNS logs to identify malicious activity and unauthorized behavior, not data classification. It does not read or scan the body of S3 objects, so it cannot determine whether an object contains sensitive information. While GuardDuty can alert on suspicious S3 access patterns, it is not designed to detect sensitive data itself.
✗
Amazon Inspector
Why it's wrong here
Amazon Inspector is a vulnerability-management service that scans workloads like EC2 instances and container images for software vulnerabilities and unintended network exposure. It does not integrate with S3 for data-content inspection, nor does it classify objects stored in S3. Because its scope is inherently compute-based, it cannot satisfy the requirement to detect sensitive data in S3 objects.
✓
Amazon Macie
Why this is correct
Amazon Macie is purpose-built to discover and protect sensitive data in Amazon S3, using machine learning and pattern matching to identify personally identifiable information (PII), credentials, and other categories. After you enable Macie, it automatically inventories S3 buckets and continuously evaluates objects for sensitive content, generating alerts when it finds them. This directly aligns with the company's requirement to detect and alert on S3 object content.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SCS-C02 Threat Detection and Incident Response Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question