SCS-C02 Threat Detection and Incident Response Practice Question

A company uses Amazon S3 to store sensitive data. The security team wants to detect and alert on public read access to S3 buckets. Which combination of AWS services is MOST appropriate?

⚠ Common exam trap

A common mix-up: candidates confuse AWS Config's compliance evaluation (which is periodic and reactive) with real-time detection and alerting, or they mistakenly believe CloudTrail captures all public access events, when in fact it only logs API calls that change permissions, not the resulting access state.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Amazon Macie with automated discovery jobs and Amazon CloudWatch Events to send alerts.

Amazon Macie is purpose-built for discovering and protecting sensitive data in S3, and its automated discovery jobs can detect public read access to buckets. By integrating with Amazon CloudWatch Events, Macie can trigger alerts in real-time when such access is identified, making it the most appropriate choice for this detection and alerting requirement.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
AWS CloudTrail and Amazon CloudWatch Logs with metric filters for `PutBucketPolicy` events.
Why it's wrong here
These services provide an audit trail of API activity. A metric filter on `PutBucketPolicy` can alert when a policy is edited, but it does not inspect the policy document for public access grants, nor does it detect buckets already made public before logging was enabled. This is passive, event-based monitoring rather than a security posture assessment.
✓
Amazon Macie with automated discovery jobs and Amazon CloudWatch Events to send alerts.
Why this is correct
Macie automatically discovers sensitive data using managed data identifiers and also evaluates S3 bucket policies and ACLs for public access. It runs automated discovery jobs on a schedule, and you can use CloudWatch Events to trigger alerts for both sensitive data findings and policy findings. This combines content discovery with access control verification, addressing both dimensions of the requirement.
✗
Amazon GuardDuty and AWS Lambda.
Why it's wrong here
GuardDuty analyzes CloudTrail, VPC flow logs, and DNS logs for threats like compromised credentials or malicious activity, but it doesn't evaluate S3 bucket policies or ACLs for public exposure. Moreover, GuardDuty isn't a configuration compliance tool; it would not detect that a policy allows "Everyone" read access unless there is a corresponding finding, which is not the case. Lambda alone could be custom-coded, but this combination is not purpose-built for this need.
✗
AWS Config with managed rules like `s3-bucket-public-read-prohibited` and Amazon SNS.
Why it's wrong here
AWS Config does continuously evaluate S3 bucket configurations against managed rules such as `s3-bucket-public-read-prohibited` and can send SNS notifications when noncompliant. However, Config only assesses the configuration of the bucket—it doesn't analyze the contents of objects for sensitive data, which is central to the requirement. Config can tell you a bucket is publicly readable, but not whether it contains PII or other sensitive data.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SCS-C02 Threat Detection and Incident Response Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question