Examkin

Question

Difficulty: Very hardCompliance and Governance

A public sector organization is migrating a legacy database to AWS and must ensure the architecture meets strict government compliance guidelines. The organization needs to retrieve AWS's third-party compliance reports and must understand the compliance boundaries under the AWS Shared Responsibility Model. Which of the following describes the correct service for retrieving these reports and the compliance responsibility division if they deploy the database on Amazon EC2?

  1. AWS Artifact is used to retrieve the compliance reports, and the customer is responsible for patching the guest operating system and the database engine.Answer
  2. B
    AWS Config is used to download the compliance certificates, and AWS is responsible for patching the database engine and the host operating system.
  3. C
    Amazon Inspector is used to retrieve the compliance documentation, and the customer is responsible only for logical database access control while AWS patches the operating system.
  4. D
    AWS Systems Manager is used to access the compliance reports, and AWS is responsible for physical security and automatically patching the EC2-hosted database engine.

Answer

AWS Artifact is used to retrieve the compliance reports, and the customer is responsible for patching the guest operating system and the database engine.
AWS Artifact is the dedicated service for retrieving AWS compliance documents, including SOC and PCI reports. Because the database is hosted on Amazon EC2, it functions as an Infrastructure as a Service (IaaS) model where the customer is responsible for patching the guest operating system and the database engine.

Step-by-Step Solution

1
Identify the service required to retrieve AWS's official third-party compliance audits and certificates.
AWS Artifact is identified as the portal providing on-demand access to AWS compliance reports (e.g., SOC, PCI, FedRAMP).
AWS Artifact serves as the centralized repository for compliance documentation.
2
Determine the boundary of responsibility for an Amazon EC2-based database deployment.
Amazon EC2 is an Infrastructure as a Service (IaaS) offering, meaning the customer is responsible for security 'in the cloud,' which includes the guest operating system, applications, database engines, and patching.
Under the Shared Responsibility Model, AWS manages security 'of the cloud' (physical host, virtualization layer) while the customer manages security 'in the cloud' (guest OS, database, and configurations).

Key Concept

AWS Artifact is the primary portal for compliance reports, and customers are responsible for guest OS and application patching on EC2 under the Shared Responsibility Model.
Rate this question

Topics

Compliance and Governance

More questions from this topic