Task 4.5: Understand data privacy and governance

• AA datashare in account A that is authorized for account B

  Correct

  Data sharing gives live access to data across clusters, workgroups and accounts without copying or moving it; the consumer account associates the datashare.

• BAn UNLOAD of the schema to S3 followed by a COPY in account B

  Incorrect

  This copies the data, and the copy is only as fresh as the last run.

• CA manual snapshot shared with account B and restored there

  Incorrect

  A restored snapshot is a separate copy of the data as of the snapshot time, not live data.

• DA federated query from account B that points to the producer cluster

  Incorrect

  Federated queries reach PostgreSQL and MySQL databases on RDS and Aurora, not another Redshift cluster.

Redshift data sharing separates storage from consumers: the producer shares objects, and consumers in other accounts query them live.

• AAWS Glue crawlers with custom classifiers on each bucket

  Incorrect

  Crawlers infer schemas for the Data Catalog. They do not identify personal data inside the objects.

• BCloudTrail data events for all S3 buckets

  Incorrect

  Data events record who accessed objects. They do not look at what the objects contain.

• CAWS Glue DataBrew profile jobs on each bucket

  Incorrect

  Profile jobs report statistics such as missing values and distributions for one dataset; they are not a managed scan of 300 buckets for PII.

• DAmazon Macie with automated sensitive data discovery

  Correct

  Macie discovers sensitive data such as PII with machine learning and pattern matching; automated discovery gives broad, ongoing visibility across buckets.

Finding PII across a large S3 estate is Macie's purpose: automated discovery for broad coverage, targeted discovery jobs for depth.

• AA Macie custom data identifier with a regex and keywords

  Correct

  A custom data identifier uses a regular expression, optionally refined with keywords and a proximity rule, to detect sensitive data that you define.

• BA Macie allow list that contains the EMP- employee ID text pattern

  Incorrect

  Allow lists define text that Macie should ignore, the opposite of what is needed.

• CA CloudWatch Logs data protection policy for the IDs

  Incorrect

  These policies mask sensitive data in log groups, not in S3 objects that Macie inspects.

• DAn AWS Config managed rule on the data lake buckets

  Incorrect

  Config rules evaluate resource configurations, not the contents of objects.

Managed identifiers cover common data types; company-specific formats need a custom data identifier, and allow lists handle the false positives.

• AS3 Event Notifications on the bucket for every new object upload

  Incorrect

  These fire when objects are created, not when Macie reports sensitive data.

• BCloudTrail data events for the objects in the data lake bucket

  Incorrect

  Data events record object-level API activity. They do not carry Macie's findings.

• CAn EventBridge rule for Macie findings, targeting Lambda and SNS

  Correct

  Macie publishes finding events to EventBridge, which can send specific types of findings to services such as Lambda for automated processing.

• DA Macie custom data identifier for each type of sensitive data

  Incorrect

  Custom data identifiers define what Macie detects. They do not act on findings.

Detection and response are separate: Macie finds, EventBridge routes, and targets such as Lambda and SNS act.

• ACloudTrail Insights events for API calls to the Amazon S3 service

  Incorrect

  Insights flags unusual API call or error rates. It does not evaluate bucket configurations.

• BS3 server access logging turned on for every bucket

  Incorrect

  Server access logs record requests to a bucket. They do not report whether its settings allow public access.

• CVPC Flow Logs for the subnets that access Amazon S3

  Incorrect

  Flow logs capture IP traffic for network interfaces, not bucket access settings.

• DThe AWS Config managed rule s3-bucket-public-read-prohibited

  Correct

  This managed rule checks Block Public Access settings, bucket policies, and ACLs and reports whether each bucket allows public read access.

Config rules turn policies into continuous compliance checks; managed rules cover common cases like public buckets.

• AAn organization trail in AWS CloudTrail for all accounts

  Incorrect

  An organization trail records API activity across accounts. It does not collect Config compliance data.

• BA conformance pack deployed to each account

  Incorrect

  Conformance packs deploy rules and remediation actions. They do not combine results from many accounts into one view.

• CAn AWS Config aggregator for the organization

  Correct

  An aggregator collects Config configuration and compliance data from an organization's accounts and Regions into one view.

• DThe Config resource timeline in each account

  Incorrect

  The timeline shows one resource's history in its own account, not a combined view of all accounts.

Rules evaluate, conformance packs deploy rules at scale, and aggregators bring the results together across accounts and Regions.

• ATurn on all S3 Block Public Access settings at the account level

  Correct

  Block Public Access settings override bucket policies and permissions that would allow public access, and account-level settings cover the account's buckets.

• BAdd a bucket policy that denies public access to each existing bucket

  Incorrect

  Per-bucket policies do not cover buckets created later, and they can be edited by the same people the control must stop.

• CAdd the Config rule s3-bucket-public-read-prohibited to the account

  Incorrect

  The rule reports whether buckets allow public read access. It detects the problem rather than preventing it.

• DSet Object Ownership to bucket owner enforced on every bucket

  Incorrect

  This disables ACLs, but a bucket policy could still grant public access.

Prevention beats detection for public data: account-level Block Public Access overrides any policy or ACL that would make a bucket public.