AWS Certified Solutions Architect Professional SAP-C02 Practice Question

Amazon Macie can be enabled organization-wide and uses managed data identifiers (including credit-card numbers) to scan every S3 object. Macie automatically publishes sensitive-data findings to Amazon EventBridge and, when enabled, to AWS Security Hub, giving analysts a central place to track incidents. An EventBridge rule can invoke an AWS Systems Manager Automation runbook-such as a custom document that calls the AWSSupport-ContainS3Resource runbook or an equivalent-to copy the offending object to an encrypted quarantine bucket and delete or lock down the source object. Because Macie, EventBridge, Security Hub, and SSM Automation are all managed services, the solution meets the detection, quarantine, and central-tracking requirements with minimal custom code and follows least-privilege by delegating narrowly scoped roles only to the automation.

GuardDuty S3 Protection does not inspect object contents and has no native quarantine action; a purely Lambda-based regex solution requires substantial custom code and management overhead; an AWS Config rule that checks encryption addresses only at-rest protection and does not detect credit-card data or quarantine objects. Therefore, enabling Macie with EventBridge-triggered SSM remediation is the most effective solution.