Examkin

Question

Difficulty: MediumCompliance and Governance

A healthcare startup is preparing for an external audit to verify compliance with HIPAA and SOC standards for its platform hosted on AWS. Which of the following actions should the startup take to meet these compliance requirements? (Select TWO.)

  1. Download official AWS compliance documents, such as SOC reports, using AWS Artifact.Answer
  2. Accept the Business Associate Addendum (BAA) with AWS using AWS Artifact.Answer
  3. C
    Request physical datacenter security audits by submitting a ticket to AWS Support.
  4. D
    Utilize Amazon Inspector to automatically apply security patches to the physical hypervisors hosting EC2 instances.
  5. E
    Configure AWS CloudTrail to monitor and block non-compliant API calls in real time.

Answer

Downloading official AWS compliance documents (such as SOC reports) using AWS Artifact, and accepting the Business Associate Addendum (BAA) with AWS using AWS Artifact.
The correct options are downloading AWS compliance documents like SOC reports through AWS Artifact, and accepting the Business Associate Addendum (BAA) using AWS Artifact. AWS Artifact serves as the direct portal for accessing compliance documentation and formalizing agreements required for regulatory frameworks like HIPAA.

Step-by-Step Solution

1
Identify the service used to retrieve compliance reports and accept regulatory agreements.
AWS Artifact is the central portal for downloading SOC reports and accepting the Business Associate Addendum (BAA).
This directly addresses both the SOC audit readiness and the HIPAA agreement requirement.
2
Differentiate customer security tasks from AWS infrastructure security tasks.
Physical host patching and security logs are managed by AWS and documented in Artifact reports, whereas customer-side auditing is logged by CloudTrail but not blocked by it.
This rules out tasks related to physical infrastructure patching and incorrect auditing service capabilities.

Key Concept

Using AWS Artifact for compliance report retrieval and agreement management under the Shared Responsibility Model.
Rate this question

Topics

Compliance and Governance

More questions from this topic