SCS-C02 Data Protection Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Amazon Macie

  Why this is correct

  Amazon Macie is a fully managed data security service that uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data stored in S3. It identifies data types such as personally identifiable information (PII), financial data, and credentials, then surfaces findings in dashboards and EventBridge events. For this use case, Macie is correct because it continuously scans and reports on sensitive data without requiring custom tooling or manual inspection.

• ✗

  AWS Artifact

  Why it's wrong here

  AWS Artifact is not a detection system but a self-service compliance portal that provides on-demand access to AWS compliance reports, including SOC, ISO, PCI, and other audit artifacts. It delivers documentation and legal agreements to support customer compliance requirements, not automated identification of sensitive data. Therefore, Artifact is incorrect because it offers evidence of compliance, not actual discovery or classification of sensitive content.

• ✗

  Amazon Inspector

  Why it's wrong here

  Amazon Inspector is a vulnerability management service that assesses workloads such as EC2 instances, ECR container images, and Lambda functions for software vulnerabilities and unintended network exposure. It focuses on security posture against CVEs and network reachability, not on inspecting data objects for sensitive content like PII. Inspector is therefore wrong because it evaluates infrastructure risk, not the sensitivity of data stored or processed.

• ✗

  Amazon GuardDuty

  Why it's wrong here

  Amazon GuardDuty performs continuous threat detection using machine learning and anomaly detection to identify malicious activity, such as compromised credentials, crypto-mining, or exfiltration attempts. It analyzes AWS CloudTrail logs, VPC Flow Logs, and DNS logs to detect threats, not to classify the content of stored data. GuardDuty is incorrect for this scenario because it detects security threats, not sensitive data classification, even though it might flag the aftermath of a data breach.

Go deeper

Related to this question