ExamPark
Course menuCLF-C02

Exams / CLF-C02 / Compliance and AWS Artifact / Question 2

CLF-C02 practice question: Compliance and AWS Artifact (2 of 2)

Security and Compliance A free question from our original CLF-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A retailer plans to process card payments on AWS services that are in scope for the PCI DSS standard.

Its CTO assumes that because every service is in scope, the payment application will be compliant without further work.

Which statement about PCI DSS on AWS is correct?

Choose one answer.

  1. A. The application becomes PCI DSS compliant automatically, since every service it uses is in scope
  2. B. AWS covers its own infrastructure, while the retailer must make its application and card data handling compliant
  3. C. The retailer must arrange its own physical audit of the AWS data centers before it can use them
  4. D. PCI DSS no longer applies once card data is stored in the cloud instead of on premises
Show the answer and explanation

Answer: B

  • A. Wrong: Incorrect. Using in-scope services does not make a customer application compliant. The customer must still assess and certify its own environment and how it handles cardholder data.
  • B. Right: Correct. AWS is certified as a PCI DSS Level 1 service provider for its infrastructure. Customers must manage their own PCI DSS compliance for the applications and cardholder data they run on AWS. Learn more: PCI DSS compliance FAQs (opens in a new tab)
  • C. Wrong: Incorrect. Customers do not audit AWS data centers themselves. AWS provides its own PCI DSS attestation, so the retailer does not need to audit the facilities to rely on it.
  • D. Wrong: Incorrect. PCI DSS applies wherever cardholder data is stored, processed or transmitted, including in the cloud. Moving the data does not remove the obligation to comply.

Explanation

AWS is certified as a PCI DSS Level 1 service provider for its own infrastructure and services. Customers still must manage their own PCI DSS compliance for the applications and cardholder data they run on AWS. Being in scope is a starting point, not a guarantee of compliance.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free CLF-C02 practice examPractice Compliance and AWS ArtifactAll Compliance and AWS Artifact questions

Want more on Compliance and AWS Artifact? The 5 full-length practice sets have 10 more Compliance and AWS Artifact questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets