Automated PII Discovery in S3 with Amazon Macie
A retail company stores customer data in an Amazon S3 bucket. Some of the customer data contains personally identifiable information (PII) about customers. The company must not share PII data with business partners. A data engineer must determine whether a dataset contains PII before making objects in the dataset available to business partners. Which solution will meet this requirement with the LEAST manual intervention?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The key insight is recognizing that Amazon Macie is the native AWS service specifically designed for automated classification and discovery of sensitive data like PII, eliminating the need for custom code or manual inspection.
This question tests automated sensitive data discovery for PII protection in Amazon S3 using Amazon Macie. The solution leverages Macie's machine learning capabilities to identify PII with minimal manual effort.
Many candidates might choose Lambda or Athena because they are familiar with them, but these require significant manual development and maintenance, violating the 'least manual intervention' requirement.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Amazon Macie is an intelligent security service that uses machine learning and pattern matching to automatically discover and classify sensitive data, such as PII, stored in Amazon S3. By configuring Macie to access the S3 bucket, it continuously scans objects and provides automated alerts or reports when PII is detected. This directly addresses the requirement to determine if a dataset contains PII before sharing it, with the least amount of manual intervention compared to building custom solutions.Why the Other Options Are Wrong
Option B (CloudTrail) monitors API calls, not the content of the data itself, so it cannot identify PII within objects. Option C (Lambda) would require writing and maintaining custom code to scan and classify data, which involves significant manual intervention and ongoing updates. Option D (Glue/Athena) also requires defining schemas and writing custom SQL queries to detect patterns, which is more labor-intensive than Macie's out-of-the-box classification.Community Comment Notes
The community consensus strongly supports option A, with multiple commenters noting that "PII -> Macie" is a standard association. Users highlighted that Macie is designed for automated sensitive data discovery, classifying, and protection without the need for manual inspection or custom functions. One user noted that Macie uses machine learning and pattern matching to automatically alert on PII, confirming its suitability for this scenario.Exam Strategy
When asked about automated PII detection or sensitive data discovery in AWS, immediately consider Amazon Macie. It is the managed service built specifically for this purpose, minimizing operational overhead compared to custom Lambda or Glue solutions.
Frequently Asked Questions
Why not use Lambda for PII scanning?
Lambda requires writing custom code to define PII patterns and maintain the logic, which violates the 'least manual intervention' constraint compared to Macie's automated ML approach.
Can CloudTrail detect PII content?
No, CloudTrail logs API activity (who did what), not the actual data payload inside S3 objects. It cannot inspect file contents for PII.
Related Analysis
Practice All DEA-C01 Questions
Access 100 questions with complete answers and detailed explanations.
View Full DEA-C01 Practice Test →