Q: 3
A company must inventory sensitive data across all Amazon S3 buckets in all accounts from a single
security account.
Options
Discussion
Option A works because Macie is built for S3 data discovery and lets you handle multiple accounts from a central security account. Quick check though, did the question specify if all S3 buckets are in the same org? That would impact the setup.
AWS really likes to toss Trusted Advisor into these options but it's always Macie for actual sensitive data inventory across S3. A imo, since you need delegated admin to scan org-wide. Security Hub pulls it all together but Macie does the heavy lifting. Open to hearing if someone made D work in real setups.
Trusted Advisor does check a lot of stuff with S3 so I'd pick D here.
Nah, not D. Trusted Advisor checks config but doesn't actually discover sensitive S3 data. It's definitely A for org-wide sensitive data inventory.
A tbh, Trusted Advisor’s a trap here, only Macie does sensitive data scans org-wide with delegation.
A , since only Macie is really built to inventory sensitive data in S3, and delegation lets you manage org-wide from a security account. Still, Security Hub mostly aggregates, so not 100% confident if I'm missing a trick. Disagree?
A
A is what I'd pick here. Macie handles sensitive data discovery in S3, and with delegated admin you get org-wide coverage from one security account. Trusted Advisor can't do actual data inventory like that. Pretty sure this is what AWS expects, but open to other takes.
Option D, seen similar in practice tests and Trusted Advisor is usually mentioned for best practices checks.
A saw a similar question in my exam report and Macie delegation was the AWS answer for S3 data discovery.
Be respectful. No spam.