ExamPark
Course menuSCS-C03

Exams / SCS-C03 / Audit evidence and best-practice reviews (AWS Artifact, Config, Well-Architected Tool) / Question 1

SCS-C03 practice question: Audit evidence and best-practice reviews (AWS Artifact, Config, Well-Architected Tool)

Security Foundations and Governance A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A health insurer runs its claims platform on AWS. An external auditor is reviewing the insurer's controls and has asked for independent evidence about the physical and environmental security of the data centers that host the platform.

The insurer has no access to AWS facilities, and the auditor accepts only third-party attestation reports. The compliance team must give the auditor this evidence the same day, without opening a support case.

Which solution meets these requirements?

Choose one answer.

  1. A. Create an AWS Audit Manager assessment from its HIPAA framework, and share the assessment report with the auditor as evidence about the data center controls.
  2. B. Deploy a HIPAA operational best practices conformance pack in every account, and give the auditor the aggregated AWS Config compliance results for the insurer's resources.
  3. C. Export the Security Hub CSPM results for the AWS Foundational Security Best Practices standard, and give them to the auditor as evidence that the hosting environment is secure.
  4. D. Download the AWS SOC 2 report from AWS Artifact after accepting its terms, and share it with the auditor as those terms permit.
Show the answer and explanation

Answer: D

  • A. Wrong: AWS Audit Manager is closed to new customers, so the insurer cannot adopt it now. Its evidence also comes from the insurer's own resources, not from attestations about AWS facilities.
  • B. Wrong: Conformance pack results show how the insurer configured its own resources. They say nothing about the physical controls in AWS data centers, which is the evidence the auditor asked for. Learn more: Conformance packs (opens in a new tab)
  • C. Wrong: Security Hub CSPM checks the insurer's account settings against best practices. Those results do not cover the physical and environmental controls that AWS runs in its facilities.
  • D. Right: Correct. AWS Artifact gives on-demand access to third-party audit reports about AWS's own controls, including physical and environmental security in its data centers. The insurer can download a report the same day without a support case. Learn more: What is AWS Artifact? (opens in a new tab)

Explanation

Under the shared responsibility model, AWS is responsible for the security of its data centers, and AWS Artifact provides the independent audit reports that attest to those controls. Config, Security Hub CSPM and Audit Manager evidence describes the customer's own resources, and Audit Manager is also closed to new customers.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free SCS-C03 practice examPractice Audit evidence and best-practice reviews (AWS Artifact, Config, Well-Architected Tool)All Audit evidence and best-practice reviews (AWS Artifact, Config, Well-Architected Tool) questions

Want more on Audit evidence and best-practice reviews (AWS Artifact, Config, Well-Architected Tool)? The 5 full-length practice sets have 5 more Audit evidence and best-practice reviews (AWS Artifact, Config, Well-Architected Tool) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets