CV0-004 Security Practice Question
A cloud security engineer is implementing a data loss prevention (DLP) strategy for sensitive data stored in Amazon S3. The company must detect and prevent accidental exposure of personally identifiable information (PII) in objects uploaded by users. The engineer needs a solution that automatically scans new objects, identifies PII, and can trigger alerts or block access. Which AWS service should the engineer use?
⚠ Common exam trap
Candidates often confuse threat detection (GuardDuty) or configuration auditing (AWS Config) with data classification and DLP capabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon Macie
Amazon Macie is purpose-built to discover and protect sensitive data in S3. It uses pattern matching and machine learning to identify PII, financial data, and credentials. It provides findings that can be integrated with Security Hub and EventBridge for automated responses. This directly addresses the need to scan new objects, detect PII, and trigger alerts or remediation actions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS GuardDuty
Why it's wrong here
GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior across AWS accounts. It analyzes CloudTrail, VPC Flow Logs, and DNS logs but does not scan S3 object contents for PII. While it can detect suspicious access patterns, it cannot identify sensitive data within objects or trigger data-specific alerts, so it does not meet the requirement.
- ✗
Amazon Inspector
Why it's wrong here
Amazon Inspector is a vulnerability management service that scans EC2 instances and container images for software vulnerabilities and unintended network exposure. It does not analyze S3 object contents for PII or other sensitive data. Its focus is on compute workloads, not data classification, so it is not suitable for this DLP scenario.
- ✓
Amazon Macie
Why this is correct
Amazon Macie is a fully managed data security and privacy service that uses machine learning to automatically discover, classify, and protect sensitive data in S3. It continuously evaluates buckets for PII and other sensitive data, providing detailed findings and alerting via EventBridge. It can also be configured to automatically remediate issues, such as blocking public access, making it the appropriate choice for this scenario.
- ✗
AWS Config
Why it's wrong here
AWS Config evaluates resource configurations against desired policies but does not inspect the contents of S3 objects. It can track changes to bucket policies and encryption settings, but it lacks the ability to detect PII within uploaded files. Therefore, it cannot fulfill the requirement to scan and identify sensitive data in objects.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This CV0-004 question is part of Courseiva's 834-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.