SAP-C03 practice question: Data protection, sovereignty and residency controls
Security, Compliance, and Governance A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A car maker stores connected-car telemetry in the EU. The data-protection office requires that personal data stay in EU Regions, and no account in the organization may create resources in a non-EU Region, even by mistake.
The company also uses Amazon Bedrock to summarize driver feedback. The summaries contain personal data, so the model calls must be processed only within EU Regions. Global services such as IAM and Route 53 must keep working for the teams.
Which TWO controls meet these requirements? (Choose two.)
Choose two answers.
AA. Configure a cross-Region replication rule from the EU telemetry buckets to a bucket in a US Region, so the data is protected by a second copy if an EU Region fails.
BB. Attach a service control policy to the organization root that denies actions when aws:RequestedRegion is not an EU Region, with NotAction for the global services the teams use.
CC. Create an AWS Config rule that reports any resource outside an EU Region, and have the compliance team delete those resources within one business day.
DD. Point the Bedrock calls at a cross-Region inference profile for the EU geography, so requests are routed only among the EU Regions that host the model.
EE. Point the Bedrock calls at the global cross-Region inference profile, so the model is always available from the Region with the most capacity.
Show the answer and explanation
Answers: B, D
A. Wrong: A copy in a US Region moves personal data outside the EU, which the data-protection office forbids. The rule breaks the residency requirement.
B. Right: Correct. The preventive SCP stops resource creation in non-EU Regions in every account, even by mistake. The NotAction list keeps global services such as IAM and Route 53 working.
C. Wrong: A detective rule reports resources after they are created, so personal data can sit outside the EU for a day before anyone deletes it. The requirement calls for prevention.
D. Right: Correct. An EU cross-Region inference profile keeps the model processing within EU Regions, so prompts with personal data stay in the EU. The application code change is limited to the model identifier.
E. Wrong: A global profile can route requests to any commercial Region, which conflicts with the requirement that the processing stay in the EU. The option trades residency for capacity.
Explanation
A preventive SCP with a RequestedRegion condition and NotAction for global services keeps resources in EU Regions, and an EU cross-Region inference profile keeps model processing in the EU. Replicating to a US Region, detecting after creation and a global profile each break the residency rule.
Want more on Data protection, sovereignty and residency controls? The 5 full-length practice sets have 8 more Data protection, sovereignty and residency controls questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →