Examkin

Question

Difficulty: Very hardCompliance and Governance

A financial trading firm hosts its transaction database on Amazon EC2 instances and stores historical backups in Amazon S3. To prepare for an upcoming audit, the compliance team must review the physical security controls of the AWS data centers and ensure the database infrastructure is patched in accordance with regulatory requirements. Which of the following actions should the team take to meet these compliance and governance requirements? (Select TWO.)

  1. Download the AWS SOC 1 report from AWS Artifact to review the physical and environmental security controls of the AWS infrastructure.Answer
  2. Apply operating system updates and security patches directly to the Amazon EC2 instances hosting the database.Answer
  3. C
    Share the downloaded AWS SOC 1 report publicly on the firm's website to satisfy the audit requirements of external stakeholders.
  4. D
    Submit a ticket to AWS Support requesting that AWS personnel apply security patches to the guest operating system of the EC2 instances.
  5. E
    Configure Amazon Inspector to automatically download the AWS SOC 1 report and audit the Amazon S3 bucket policies.

Answer

To meet compliance requirements, the compliance team must download the AWS SOC 1 report from AWS Artifact to review physical and environmental security controls, and they must directly apply operating system updates and security patches to the Amazon EC2 instances hosting the database.
The correct options are downloading the SOC 1 report from AWS Artifact and applying OS patches directly to the EC2 instances. AWS Artifact is the dedicated platform for compliance document retrieval, which allows customers to verify AWS physical controls. In addition, because the transaction database is hosted on Amazon EC2, the customer is fully responsible for configuring and patching the guest operating system under the Shared Responsibility Model.

Step-by-Step Solution

1
Determine the source for physical and environmental security compliance reports of AWS infrastructure.
Identify AWS Artifact as the centralized portal where AWS hosts compliance documents like SOC 1, SOC 2, and PCI reports.
AWS manages the physical security of the cloud, and customers verify this through official third-party audit reports provided via AWS Artifact.
2
Understand the confidentiality rules associated with AWS compliance reports.
Recognize that AWS Artifact documents require accepting a non-disclosure agreement (NDA) and cannot be distributed publicly.
Sharing proprietary and confidential audit reports publicly violates the terms of service.
3
Apply the Shared Responsibility Model to the database architecture (Amazon EC2).
Confirm that the customer is responsible for guest operating system patching, application management, and data configuration on EC2.
Since EC2 is an infrastructure service, the customer has root/administrator access and sole control over the operating system, making them responsible for applying OS security updates.

Key Concept

AWS compliance reporting via AWS Artifact and the division of patching duties under the Shared Responsibility Model.
Rate this question

Topics

Compliance and Governance

More questions from this topic