DEA-C01 Practice Question 29: Macie Automated Discovery Estate
AWS Certified Data Engineer – Associate (DEA-C01) · Test 3 · question 9 of 10
A security team needs a continuously updated picture of which of the roughly 900 Amazon S3 buckets across an AWS Organization are likely to contain sensitive data, so they can prioritize a remediation backlog. Bucket ownership is spread across dozens of member accounts, and new buckets appear every week. Scanning every object in the estate on a schedule was rejected as too expensive.
Which approach should they use?
Show answer and explanation
Answer:
Automated sensitive data discovery is built for estate-wide, continuous assessment. Macie "evaluates your inventory data on a daily basis to identify S3 objects that are eligible for automated discovery" and "uses sampling techniques to select representative S3 objects to analyze", grouping objects by dimensions such as bucket name, prefix, storage class, and file extension. Because it samples rather than scanning everything, cost stays bounded, and the breadth-first strategy covers as many buckets as possible each day; results can start appearing within 48 hours. Each bucket gets a sensitivity score and label, which is precisely the prioritized view the team wants. Run from the Macie administrator account, it covers member accounts' buckets automatically, so buckets created next week are picked up without anyone configuring them.
Option A is the approach that was explicitly rejected. A discovery job that scans all objects in all buckets is charged on the volume of data inspected, and re-running it weekly repeats that cost over data that has not changed. Jobs are also point-in-time; keeping them aligned with a growing bucket inventory is ongoing work.
Option C sees only data that happens to pass through an ETL job. Buckets holding raw uploads, exports, or files nobody has built a pipeline for, often the riskiest ones, are never examined.
Option D inspects names, not content. A bucket called landing-zone may be full of customer records and a bucket called pii-archive may be empty. Key-name matching produces both false positives and false negatives and cannot produce a defensible sensitivity assessment.
Reference: How automated sensitive data discovery works