An external auditor asks where the city can download AWS compliance reports and security/compliance agreements. Which AWS resource should staff use?
Select an answer to reveal the explanation.
Short Explanation
Auditors need the official paperwork drawer, not a threat screen or random bucket. Use AWS Artifact for on-demand compliance reports and agreements. GuardDuty and instance metadata solve different problems.
Full Explanation
AWS Artifact provides on-demand access to AWS compliance reports and agreements that auditors commonly request — for example SOC-related packages and other attestations AWS makes available to customers. That is the official paperwork drawer for AWS's side of many compliance conversations with a city risk office. Amazon EC2 instance metadata is wrong because instance metadata is not a store for PCI attestation letters. The Amazon GuardDuty findings console is wrong because GuardDuty is a threat-detection surface, not the download site for SOC reports. Amazon S3 public sample buckets are wrong because public sample buckets are not the default host for all AWS audit letters. The distractors fail by pointing auditors at metadata services, threat consoles, or random public buckets instead of Artifact. Exam caveat: Artifact helps with AWS compliance documentation; it does not automatically make a municipal application compliant without customer-side controls, configurations, and evidence packages. Operational check: grant appropriate staff Artifact access before audit season, download relevant reports for the services in scope, store them in the city's GRC repository, and map those AWS reports to the control narrative rather than substituting them for application-level evidence such as access reviews.