Examkin

Question

Difficulty: HardCompliance and Governance

A pharmaceutical company is launching a new research database containing proprietary clinical trial data on AWS. To meet strict regulatory standards, the compliance team must download the AWS SOC 2 Type II report and verify that data protection standards are maintained. Which of the following actions must the company take to meet these compliance objectives? (Select TWO.)

  1. Retrieve the AWS SOC 2 Type II report through the self-service portal in AWS Artifact.Answer
  2. Enable encryption at rest for the Amazon RDS DB instances storing the clinical trial data.Answer
  3. C
    Submit a request to the AWS Compliance team to email the confidential SOC 2 audit reports.
  4. D
    Rely on AWS to manage operating system updates and security patches for the EC2 instances that access the database.
  5. E
    Deploy Amazon GuardDuty to automatically scan and remediate software licensing compliance issues on the database instances.

Answer

Retrieve the AWS SOC 2 Type II report through the self-service portal in AWS Artifact, and enable encryption at rest for the Amazon RDS DB instances storing the clinical trial data.
Retrieving compliance documents like SOC 2 reports is done via the self-service AWS Artifact console. Additionally, securing data at rest in Amazon RDS DB instances is a customer responsibility under the Shared Responsibility Model.

Step-by-Step Solution

1
Identify the service for compliance documentation.
Determine that AWS Artifact is the repository for on-demand compliance reports, eliminating the need to contact AWS support.
Retrieving the SOC 2 Type II report is necessary to verify the security of the AWS physical and cloud infrastructure.
2
Delineate security responsibilities under the Shared Responsibility Model.
Confirm that database encryption at rest (data protection) and guest operating system patching on EC2 instances are customer responsibilities, whereas physical security and hypervisor maintenance are AWS responsibilities.
This determines which security actions must be configured directly by the company's administrators.
3
Select the correct combination of customer-managed settings and compliance report retrieval.
Choose the option to retrieve the SOC 2 report from AWS Artifact and the option to configure RDS encryption at rest.
This satisfies both the compliance documentation requirement and the customer data protection obligation.

Key Concept

AWS Compliance and the Shared Responsibility Model
Estimated Time:2m 0s
Rate this question

Topics

Compliance and Governance

More questions from this topic