Exams / SAP-C03 / Study guide / Audit trails, compliance evidence and threat modeling (AWS Artifact)
Audit trails, compliance evidence and threat modeling (AWS Artifact): SAP-C03 study notes and practice questions
What to know about Audit trails, compliance evidence and threat modeling (AWS Artifact) for the SAP-C03 exam, from the Security, Compliance, and Governance domain (25% of the exam guide), then 1 free question to test it. Part of the SAP-C03 study guide.
These questions ask how to prove compliance: show auditors who did what, provide AWS’s own certifications, and show you assessed and reduced the risks of a new design.
Audit trails for regulated workloads
Organization CloudTrail trail to a central log archive bucket, with log file validation (digest files prove logs weren’t changed) and S3 Object Lock in compliance mode for write-once retention.
Data events for the buckets, tables and functions holding regulated data, because management events alone don’t show who read a record.
AI services: CloudTrail records Bedrock API calls; model invocation logging records prompts and responses to CloudWatch Logs or S3. Keep both, encrypted and retained to the rule’s period, with access limited to auditors.
Config keeps resource configuration history, so you can show what a resource looked like at any point.
Set retention with S3 Lifecycle (for example to Glacier storage classes) and CloudWatch Logs retention settings.
Compliance evidence
AWS Artifact is the self-service portal for AWS’s own compliance reports (SOC, PCI, ISO and others) and for agreements such as the Business Associate Addendum (BAA) for HIPAA, which you can accept for one account or for the whole organization from the management account.
Artifact proves AWS’s side of the shared responsibility model; your side is shown with your own evidence.
Config conformance packs and Security Hub CSPM standards give continuous, exportable compliance status per control.
AWS Audit Manager is closed to new customers, so design new evidence collection on Config, Security Hub CSPM and your own reporting (for example Athena or QuickSight over exported findings).
Risk assessment and threat modeling
Threat modeling early in design: identify assets, data flows and trust boundaries, list threats (STRIDE is a common method), and map each to a mitigation such as encryption, least privilege, WAF or segmentation. AWS’s open-source Threat Composer tool helps document this.
The Well-Architected Framework security pillar and the AWS Well-Architected Tool support structured reviews.
Track residual risks and re-assess when the architecture changes; feed findings from GuardDuty, Inspector and Access Analyzer back into the model.
How to choose
Scenario wording
Pick
Auditor wants AWS’s SOC 2 or PCI report
AWS Artifact reports
HIPAA BAA for every account
AWS Artifact organization agreement
Prove logs weren’t altered
Log file validation plus Object Lock
Prove who read regulated objects
CloudTrail data events
Keep every prompt and response
Bedrock model invocation logging
Show continuous control status
Config conformance packs, Security Hub CSPM
Assess risks of a new design
Threat modeling with documented mitigations
Common traps
Using Artifact as proof of your own controls; it covers AWS’s.
Management events only when the rule is about data access.
Logs kept in the workload account where admins could delete them.
Recommending services closed to new customers (Audit Manager, CloudTrail Lake) for a new design.
A streaming service that takes subscription payments is preparing for an external audit. The auditor asks for AWS's independent SOC 2 report and PCI DSS attestation of compliance, and for proof that one customer-facing S3 bucket never allowed public read access during the 12-month audit period.
AWS Config has recorded every resource in the account for the past two years. The compliance team wants to collect this evidence itself, without opening support cases, and the bucket proof must show its settings over time, not only at one point.
Which solution meets these requirements?
Choose one answer.
AA. Open a support case asking AWS to confirm in writing that the bucket never allowed public access, and ask the account team to email the SOC 2 report and the PCI DSS attestation.
BB. Download the CloudTrail event history for the bucket, which lists the API calls made against it, and give it to the auditor along with reports requested through the account team.
CC. Download the SOC 2 report and the PCI DSS attestation from AWS Artifact, and use the AWS Config configuration history of the bucket to show its public-access settings over the audit period.
DD. Build a custom script that copies the bucket's policy to a spreadsheet each day, and attach the spreadsheet and a screenshot of the AWS console for the auditor.
Show the answer and explanation
Answer: C
A. Wrong: Support cases are what the compliance team wants to avoid, and a written confirmation is not a record of the bucket's settings over time. This option misses both the self-service and the history requirement.
B. Wrong: Event history covers only the last 90 days of management events, so it does not span the 12-month period, and it records calls rather than the bucket's configuration. Requesting the reports through the account team also misses the self-service need.
C. Right: Correct. AWS Artifact provides AWS's audit reports on a self-service basis. AWS Config records the bucket's configuration over time, so its history shows the public-access settings for the whole period.
D. Wrong: A custom script adds an unverified process that the auditor cannot trust as independent evidence. The team would be building the evidence collection that AWS services already provide.
Explanation
AWS Artifact supplies AWS's SOC 2 report and PCI DSS attestation on a self-service basis, and AWS Config keeps the configuration history that shows the bucket's public-access state over the whole period. Support cases, 90 days of CloudTrail event history and home-made spreadsheets each fail the self-service or history requirement.
Want more on Audit trails, compliance evidence and threat modeling (AWS Artifact)? The 5 full-length practice sets have 6 more Audit trails, compliance evidence and threat modeling (AWS Artifact) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Audit trails, compliance evidence and threat modeling (AWS Artifact)