SAP-C03 practice question: Audit trails, compliance evidence and threat modeling (AWS Artifact)
Security, Compliance, and Governance A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A streaming service that takes subscription payments is preparing for an external audit. The auditor asks for AWS's independent SOC 2 report and PCI DSS attestation of compliance, and for proof that one customer-facing S3 bucket never allowed public read access during the 12-month audit period.
AWS Config has recorded every resource in the account for the past two years. The compliance team wants to collect this evidence itself, without opening support cases, and the bucket proof must show its settings over time, not only at one point.
Which solution meets these requirements?
Choose one answer.
AA. Open a support case asking AWS to confirm in writing that the bucket never allowed public access, and ask the account team to email the SOC 2 report and the PCI DSS attestation.
BB. Download the CloudTrail event history for the bucket, which lists the API calls made against it, and give it to the auditor along with reports requested through the account team.
CC. Download the SOC 2 report and the PCI DSS attestation from AWS Artifact, and use the AWS Config configuration history of the bucket to show its public-access settings over the audit period.
DD. Build a custom script that copies the bucket's policy to a spreadsheet each day, and attach the spreadsheet and a screenshot of the AWS console for the auditor.
Show the answer and explanation
Answer: C
A. Wrong: Support cases are what the compliance team wants to avoid, and a written confirmation is not a record of the bucket's settings over time. This option misses both the self-service and the history requirement.
B. Wrong: Event history covers only the last 90 days of management events, so it does not span the 12-month period, and it records calls rather than the bucket's configuration. Requesting the reports through the account team also misses the self-service need.
C. Right: Correct. AWS Artifact provides AWS's audit reports on a self-service basis. AWS Config records the bucket's configuration over time, so its history shows the public-access settings for the whole period.
D. Wrong: A custom script adds an unverified process that the auditor cannot trust as independent evidence. The team would be building the evidence collection that AWS services already provide.
Explanation
AWS Artifact supplies AWS's SOC 2 report and PCI DSS attestation on a self-service basis, and AWS Config keeps the configuration history that shows the bucket's public-access state over the whole period. Support cases, 90 days of CloudTrail event history and home-made spreadsheets each fail the self-service or history requirement.
Want more on Audit trails, compliance evidence and threat modeling (AWS Artifact)? The 5 full-length practice sets have 6 more Audit trails, compliance evidence and threat modeling (AWS Artifact) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →