A new AWS account will host many S3 buckets for applications and CloudTrail logs. Amazon Macie is enabled for the account. A DevOps engineer must reduce Macie costs while preserving required functionality. Which actions will lower cost without losing needed coverage? (Choose two.)
Choose an answer
Tap an option to check your answer.
Correct answer: Exclude S3 buckets that store CloudTrail logs from Macie automated discovery., Configure Macie discovery jobs to include S3 objects selectively based on their last modified timestamp..
Why this is the answer
Excluding S3 buckets storing CloudTrail logs from Macie automated discovery is effective because CloudTrail logs contain operational data, not sensitive customer information, making their scanning by Macie unnecessary for data protection and thus reducing cost. Configuring Macie discovery jobs to include S3 objects selectively based on their last modified timestamp allows you to focus scanning on recently changed or created objects, which are more likely to contain new sensitive data, thereby reducing the overall volume of data scanned and lowering costs. Excluding buckets with public read access is incorrect because publicly accessible buckets are often a high-risk area for sensitive data exposure and should be monitored. Scheduling daily discovery for all buckets would increase costs, not reduce them. Including only production-tagged objects might miss sensitive data in non-production environments.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed