Question

Difficulty: MediumCompliance and Governance

An online education platform is expanding its services to support medical residency programs and needs to ensure compliance with the Health Insurance Portability and Accountability Act (HIPAA). To do this, the platform's administrator needs to review AWS security documentation and formally accept the AWS Business Associate Addendum (BAA). Which of the following tasks can the administrator perform using AWS Artifact to meet these requirements? (Select TWO.)

  1. Download AWS compliance reports, such as SOC and PCI-DSS documents, to review the security controls of AWS infrastructureAnswer
  2. Formally accept agreements with AWS, such as the Business Associate Addendum (BAA) for HIPAA complianceAnswer
  3. C
    Track and log API activity across the AWS account to audit user actions and meet compliance logging requirements
  4. D
    Run automated vulnerability scans on Amazon EC2 instances to verify they meet compliance patch standards
  5. E
    Request an on-site physical audit of AWS data centers to verify physical security compliance

Answer

Downloading AWS compliance reports to review security controls of the AWS infrastructure and formally accepting agreements with AWS, such as the Business Associate Addendum (BAA), are correct.
AWS Artifact serves as the self-service portal to download AWS security and compliance reports (such as SOC and PCI reports) and to manage and accept agreements (such as the BAA for HIPAA compliance).

Step-by-Step Solution

1
Identify the service mentioned in the question.
The question asks about tasks performed using AWS Artifact.
AWS Artifact is the central repository for AWS compliance-related information.
2
Determine the two primary capabilities of AWS Artifact.
AWS Artifact consists of two main sections: AWS Artifact Reports (providing compliance reports like SOC, PCI, ISO) and AWS Artifact Agreements (allowing customers to accept agreements like the HIPAA BAA).
This matches the requirements of downloading compliance reports and signing the BAA.
3
Evaluate the other options to rule out services that are not AWS Artifact.
API logging is handled by AWS CloudTrail, vulnerability scanning is done by Amazon Inspector, and physical data center security audits are not permitted for customers.
This isolates the correct options and ensures no incorrect alternatives are selected.

Key Concept

AWS Artifact provides on-demand access to AWS compliance reports and allows customers to accept agreements like the Business Associate Addendum (BAA).
Rate this question