Compliance and AWS Artifact: CLF-C02 study notes and practice questions
What to know about Compliance and AWS Artifact for the CLF-C02 exam, from the Security and Compliance domain (30% of the exam guide), then 2 free questions to test it. Part of the CLF-C02 study guide.
Compliance questions test where to find evidence that AWS meets a standard, and who is responsible for meeting it.
Key facts
AWS Artifact is the self-service portal for AWS’s compliance reports (such as SOC reports, ISO certifications and PCI DSS attestations) and agreements (such as the Business Associate Addendum for HIPAA). It’s the answer whenever an auditor asks for AWS’s reports.
AWS Compliance Programs cover many standards and laws: SOC 1, 2 and 3, ISO 27001, PCI DSS Level 1, HIPAA eligibility, FedRAMP, GDPR support and others. The list varies by service, so check AWS Services in Scope by Compliance Program.
Inherited controls: a customer running on AWS inherits AWS’s controls for the physical and infrastructure layers, but still has to meet the standard for its own data, configuration and processes.
Data residency: the customer chooses the Region where its data is stored, and AWS doesn’t move it out of that Region without the customer’s agreement.
AWS Audit Manager helps customers collect evidence of their own compliance from their AWS usage.
AWS Config with conformance packs checks resource configurations against compliance rules.
How to choose
Need
Service
Download AWS’s SOC 2 report for an auditor
AWS Artifact
Accept a HIPAA Business Associate Addendum
AWS Artifact (agreements)
Gather evidence that our account meets a framework
AWS Audit Manager
Check that our resources follow configuration rules
AWS Config
Keep data in Germany
Choose the Frankfurt Region
Common traps
Thinking AWS’s certification makes your application compliant. AWS is PCI DSS Level 1 for its infrastructure, but your application still needs its own compliance work.
Artifact vs Audit Manager. Artifact gives AWS’s reports; Audit Manager collects evidence about your use of AWS.
A company must keep its customers' personal data within the European Union to meet a regulation.
It is planning which AWS Regions to use for the application that stores this data.
Who decides which AWS Region the data is stored in?
Choose one answer.
AA. AWS, which places data in the Region with the most spare capacity
BB. The regulator, which assigns each company an AWS Region
CC. AWS Support, after the company opens a compliance case
DD. The company, by choosing the Region for its resources
Show the answer and explanation
Answer: D
A. Wrong: Incorrect. AWS does not choose storage Regions based on spare capacity. Customers choose the Regions where their content is stored, so this placement would not satisfy the regulation.
B. Wrong: Regulators set rules about where data may be kept, but they do not assign AWS Regions. The company decides which Regions it uses, within those rules.
C. Wrong: AWS Support helps with technical and account questions, but it does not select the Region for a customer's content. The customer chooses the Region when it creates its resources.
The customer chooses the AWS Region in which its content is stored, and AWS does not move that content out of the chosen Regions without the customer's agreement, apart from limited legal exceptions. The company therefore picks EU Regions for this data and confirms that the choice meets its regulation.
A retailer plans to process card payments on AWS services that are in scope for the PCI DSS standard.
Its CTO assumes that because every service is in scope, the payment application will be compliant without further work.
Which statement about PCI DSS on AWS is correct?
Choose one answer.
AA. The application becomes PCI DSS compliant automatically, since every service it uses is in scope
BB. AWS covers its own infrastructure, while the retailer must make its application and card data handling compliant
CC. The retailer must arrange its own physical audit of the AWS data centers before it can use them
DD. PCI DSS no longer applies once card data is stored in the cloud instead of on premises
Show the answer and explanation
Answer: B
A. Wrong: Incorrect. Using in-scope services does not make a customer application compliant. The customer must still assess and certify its own environment and how it handles cardholder data.
B. Right: Correct. AWS is certified as a PCI DSS Level 1 service provider for its infrastructure. Customers must manage their own PCI DSS compliance for the applications and cardholder data they run on AWS. Learn more: PCI DSS compliance FAQs (opens in a new tab)
C. Wrong: Incorrect. Customers do not audit AWS data centers themselves. AWS provides its own PCI DSS attestation, so the retailer does not need to audit the facilities to rely on it.
D. Wrong: Incorrect. PCI DSS applies wherever cardholder data is stored, processed or transmitted, including in the cloud. Moving the data does not remove the obligation to comply.
Explanation
AWS is certified as a PCI DSS Level 1 service provider for its own infrastructure and services. Customers still must manage their own PCI DSS compliance for the applications and cardholder data they run on AWS. Being in scope is a starting point, not a guarantee of compliance.
Want more on Compliance and AWS Artifact? The 5 full-length practice sets have 10 more Compliance and AWS Artifact questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →