SCS-C03 Question #117: Real Exam Question with Answer & Explanation

Question

A healthcare company stores more than 1 million patient records in an Amazon S3 bucket. The patient records include personally identifiable information (PII). The S3 bucket contains hundreds of terabytes of data. A security engineer receives an alert that was triggered by an Amazon GuardDuty Exfiltration:S3/AnomalousBehavior finding. The security engineer confirms that an attacker is using temporary credentials that were obtained from a compromised Amazon EC2 instance that has s3:GetObject permissions for the S3 bucket. The attacker has begun downloading the contents of the bucket. The security engineer contacts a development team. The development team will require 4 hours to implement and deploy a fix. The security engineer must take immediate action to prevent the attacker from downloading more data from the S3 bucket. Which solution will meet this requirement?

Options

• ARevoke the temporary session that is associated with the instance profile that is attached to the
• BQuarantine the EC2 instance by replacing the existing security group with a new security group
• CEnable Amazon Macie on the S3 bucket. Configure the managed data identifiers for personally
• DApply an S3 bucket policy temporarily. Configure the policy to deny read access for all principals