Examkin

Question

Difficulty: MediumCompliance and Governance

A smart-home IoT device manufacturer is preparing for a security audit of its database systems. The compliance team must review AWS physical infrastructure security controls via a SOC 2 report and verify who is responsible for patching the guest operating systems on their Amazon EC2 instances. Which of the following actions should the company take to meet these compliance and operational requirements? (Select TWO.)

  1. Download the AWS SOC 2 report from AWS Artifact.Answer
  2. Apply security patches to the guest operating systems of the Amazon EC2 instances.Answer
  3. C
    Submit a request to the AWS Support team to obtain the physical security reports for the AWS data centers.
  4. D
    Rely on AWS to automatically patch the guest operating systems of the Amazon EC2 instances.
  5. E
    Use Amazon Inspector to retrieve the AWS SOC 2 compliance reports.

Answer

Downloading the AWS SOC 2 report from AWS Artifact and patching the guest operating systems on the Amazon EC2 instances.
The correct actions are downloading the compliance reports directly from AWS Artifact and taking responsibility for patching the guest operating system on EC2 instances. AWS Artifact is the self-service portal for AWS compliance reports, and under the Shared Responsibility Model, patching the guest operating system of EC2 instances is the customer's responsibility.

Step-by-Step Solution

1
Identify where third-party compliance reports are stored and retrieved in AWS.
Determine that AWS Artifact is the central portal for downloading reports like SOC 2.
AWS Artifact provides on-demand, self-service access to AWS compliance documentation.
2
Analyze the division of patching responsibilities for Amazon EC2 instances under the Shared Responsibility Model.
Identify that AWS patches the physical host and hypervisor, while the customer patches the guest operating system.
Amazon EC2 is an Infrastructure as a Service (IaaS) offering, giving the customer full control and responsibility over the operating system.

Key Concept

AWS compliance reports retrieval via AWS Artifact and the division of patching responsibilities under the Shared Responsibility Model.
Rate this question

Topics

Compliance and Governance

More questions from this topic