MLA-C01 Practice Question 32: Sensitive Data Discovery Macie
AWS Certified Machine Learning Engineer – Associate (MLA-C01) · Test 4 · question 2 of 10
An insurance company plans to train a claims-triage model on documents that several business units have dumped into about 40 Amazon S3 buckets over the years. The files are a mix of CSV exports, JSON logs, and free-text notes, and nobody has an inventory of what they contain. Before any data is copied into the training account, the compliance team requires a report showing which buckets and objects contain personally identifiable information such as names, addresses, and policy numbers.
Which approach produces this report with the least custom development?
Show answer and explanation
Answer:
Amazon Macie discovers sensitive data in Amazon S3 using machine learning and pattern matching. It ships with managed data identifiers for common PII such as names and addresses, and lets you add custom data identifiers (a regex plus optional keywords) for patterns specific to the business, such as policy numbers. When Macie finds sensitive data in an object, it records a finding naming the bucket and object, which is the per-object report compliance asked for. It also reads the contents of the files, so it catches PII inside free-text notes (option D).
- A is wrong because a crawler infers schemas and records column names and types. It does not inspect values, so a column called notes full of home addresses looks harmless, and free text has no meaningful columns at all. - B would find PII, but it is exactly the custom development the requirement rules out: you must write the Lambda function, handle every file format, get around Lambda's timeout and payload limits on large objects, add policy number detection yourself, and build the report. Macie already does all of this as a managed service. - C is wrong because CloudTrail data events record who accessed which objects. They say nothing about what the objects contain.
Reference: What is Amazon Macie?