SCS-C02 · Question #256
A medical company recently completed an acquisition and inherited an existing AWS environment. The company has an upcoming audit and is concerned about the compliance posture of its acquisition. The…
The correct answer is A. Enable Amazon Macie. Run an on-demand sensitive data discovery job that uses the E. Enable AWS Security Hub. Use the AWS Foundational Security Best Practices standard. Review F. Enable AWS Config Set up the s3-bucket-public-write-prohibited AWS Config managed rule. Amazon Macie (A) is purpose-built for discovering sensitive data - including PHI - inside S3 buckets with minimal setup, making it the clear choice for the data discovery requirement. AWS Security Hub with the Foundational Security Best Practices standard (E) automatically runs…
Question
A medical company recently completed an acquisition and inherited an existing AWS environment. The company has an upcoming audit and is concerned about the compliance posture of its acquisition. The company must identify personal health information inside Amazon S3 buckets and must identify S3 buckets that are publicly accessible. The company needs to prepare for the audit by collecting evidence in the environment. Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose three.)
Options
- AEnable Amazon Macie. Run an on-demand sensitive data discovery job that uses the
- BUse AWS Glue with the Detect Pll transform to identify sensitive data and to mask the sensitive
- CEnable AWS Audit Manager. Create an assessment by using a supported framework.
- DEnable Amazon GuardDuty S3 Protection Document any findings that are related to suspicious
- EEnable AWS Security Hub. Use the AWS Foundational Security Best Practices standard. Review
- FEnable AWS Config Set up the s3-bucket-public-write-prohibited AWS Config managed rule.
How the community answered
(23 responses)- A70% (16)
- B17% (4)
- C4% (1)
- D9% (2)
Explanation
Amazon Macie (A) is purpose-built for discovering sensitive data - including PHI - inside S3 buckets with minimal setup, making it the clear choice for the data discovery requirement. AWS Security Hub with the Foundational Security Best Practices standard (E) automatically runs checks against S3 configurations (including public accessibility) and aggregates findings into audit-ready evidence. AWS Config with the s3-bucket-public-write-prohibited rule (F) is a managed, low-overhead rule that directly flags publicly writable S3 buckets and maintains a compliance history useful for auditors.
Why the distractors are wrong:
- (B) AWS Glue Detect PII can find PII but requires building and managing ETL pipelines - far more operational overhead than Macie, and it's not designed for audit evidence collection.
- (C) AWS Audit Manager collects evidence against compliance frameworks but does not discover PHI or assess S3 public accessibility on its own.
- (D) GuardDuty S3 Protection detects threats and suspicious access patterns - it does not inventory sensitive data or flag misconfigured public buckets.
Memory tip: Match the tool to the job - Macie = "find my data", Security Hub = "show my posture", Config = "enforce my rules". If a question asks about PHI discovery + public bucket detection + least overhead, those three tools are your triangle.
Topics
Community Discussion
No community discussion yet for this question.