Exams / CLF-C02 / Compliance and AWS Artifact / Question 2
CLF-C02 practice question: Compliance and AWS Artifact (2 of 2)
Security and Compliance A free question from our original CLF-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A company plans to run its card-payment application on AWS services that are in scope for the PCI DSS standard. Which statement is correct?
Choose one answer.
- AA. The application becomes PCI DSS compliant automatically because every service it uses is in scope.
- BB. AWS covers its infrastructure controls; the company must make its own application and data handling compliant.
- CC. The company must arrange its own physical audit of the AWS data centres before it can use them.
- DD. PCI DSS no longer applies once the card data is stored in the cloud instead of on premises.
Show the answer and explanation
Answer: B
- A. Wrong: Running on in-scope services does not make the customer's own application compliant. The customer must still meet its share of the requirements.
- B. Right: Correct. Compliance follows the shared responsibility model. The company can use AWS's reports for the infrastructure layer but must address its own layer.
- C. Wrong: Customers use AWS's third-party audit reports, available in AWS Artifact, instead of auditing AWS facilities themselves.
- D. Wrong: The standard applies wherever cardholder data is stored, processed or transmitted, including in the cloud.
Explanation
AWS being certified against a standard covers the infrastructure that AWS operates. The customer is still responsible for the compliance of what it builds on top: its application, its configuration of services and how it handles data. AWS Artifact provides AWS's audit reports to support the customer's own compliance work.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.