Data protection, sovereignty and residency controls: SAP-C03 study notes and practice questions
What to know about Data protection, sovereignty and residency controls for the SAP-C03 exam, from the Security, Compliance, and Governance domain (25% of the exam guide), then 1 free question to test it. Part of the SAP-C03 study guide.
These questions give a regulation (data must stay in the EU, health data must be encrypted and every access logged, a government requires keys held in country) and ask which design satisfies it without breaking the application.
Data protection basics
Protection is three layers working together, and the exam expects all three:
Encryption at rest with customer managed KMS keys and in transit with TLS (KMS, TLS and HSMs).
Access control with least-privilege IAM, resource policies, S3 Block Public Access, and data perimeter controls.
Audit logging with CloudTrail (including data events for sensitive buckets), Config history and S3 server access logs.
Amazon Macie discovers and classifies sensitive data such as PII in S3 so you know where the controls must apply.
Keeping data in a Region
AWS stores your content in the Regions you choose and doesn’t move it unless you or a service you configure does. The architect’s job is to stop people and services from configuring that.
Region deny: a Control Tower Region deny control or an SCP using aws:RequestedRegion, with exemptions for global services. Use a separate OU for workloads with different residency rules.
Replication: S3 replication, DynamoDB global tables, Aurora Global Database, AWS Backup cross-Region copies and multi-Region KMS keys all copy data out of the Region. Restrict or block them for in-scope data, for example with SCPs on the replication and copy actions.
Edge and caching: CloudFront caches content at edge locations worldwide; use geographic restrictions or keep regulated data out of cached responses.
AI inference: Bedrock cross-Region inference can process requests in other Regions. Choose a geographic inference profile (such as an EU or US profile) rather than global, or in-Region invocation, when processing must stay within a geography.
Local requirements: AWS Outposts or Local Zones for data or processing that must stay on premises or in a specific metro.
Sovereignty and key control
Keys held by you: imported key material, a CloudHSM custom key store, or an external key store (XKS) with the HSM outside AWS, so you can cut off access.
Customer managed keys per Region (not multi-Region keys) keep cryptographic material local.
How to choose
Scenario wording
Pick
No resources outside approved Regions
Region deny control or SCP with aws:RequestedRegion
Find where PII lives
Macie
Generative AI must process in the EU only
Bedrock EU geographic inference profile or in-Region
Keys must stay outside AWS
KMS external key store
Data can’t leave the facility
Outposts
Common traps
Multi-Region keys or global tables for data that must stay in one Region.
A Region-deny SCP that blocks IAM or other global services.
Global cross-Region inference when a residency rule applies.
Encryption alone as the answer to a sovereignty rule that’s really about location or key custody.
A car maker stores connected-car telemetry in the EU. The data-protection office requires that personal data stay in EU Regions, and no account in the organization may create resources in a non-EU Region, even by mistake.
The company also uses Amazon Bedrock to summarize driver feedback. The summaries contain personal data, so the model calls must be processed only within EU Regions. Global services such as IAM and Route 53 must keep working for the teams.
Which TWO controls meet these requirements? (Choose two.)
Choose two answers.
AA. Configure a cross-Region replication rule from the EU telemetry buckets to a bucket in a US Region, so the data is protected by a second copy if an EU Region fails.
BB. Attach a service control policy to the organization root that denies actions when aws:RequestedRegion is not an EU Region, with NotAction for the global services the teams use.
CC. Create an AWS Config rule that reports any resource outside an EU Region, and have the compliance team delete those resources within one business day.
DD. Point the Bedrock calls at a cross-Region inference profile for the EU geography, so requests are routed only among the EU Regions that host the model.
EE. Point the Bedrock calls at the global cross-Region inference profile, so the model is always available from the Region with the most capacity.
Show the answer and explanation
Answers: B, D
A. Wrong: A copy in a US Region moves personal data outside the EU, which the data-protection office forbids. The rule breaks the residency requirement.
B. Right: Correct. The preventive SCP stops resource creation in non-EU Regions in every account, even by mistake. The NotAction list keeps global services such as IAM and Route 53 working.
C. Wrong: A detective rule reports resources after they are created, so personal data can sit outside the EU for a day before anyone deletes it. The requirement calls for prevention.
D. Right: Correct. An EU cross-Region inference profile keeps the model processing within EU Regions, so prompts with personal data stay in the EU. The application code change is limited to the model identifier.
E. Wrong: A global profile can route requests to any commercial Region, which conflicts with the requirement that the processing stay in the EU. The option trades residency for capacity.
Explanation
A preventive SCP with a RequestedRegion condition and NotAction for global services keeps resources in EU Regions, and an EU cross-Region inference profile keeps model processing in the EU. Replicating to a US Region, detecting after creation and a global profile each break the residency rule.
Want more on Data protection, sovereignty and residency controls? The 5 full-length practice sets have 8 more Data protection, sovereignty and residency controls questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Data protection, sovereignty and residency controls