External assessors ask a municipal cloud team for official AWS compliance documentation packages rather than unofficial blog summaries. Where should the team obtain those AWS compliance reports?
Select an answer to reveal the explanation.
Short Explanation
Artifact is the official filing cabinet for AWS compliance packets — assessors want those documents, not a blog rewrite. CloudWatch and Shield solve monitoring and DDoS; they are not the compliance report portal.
Full Explanation
AWS Artifact provides on-demand access to AWS compliance reports and agreements — the official filing cabinet assessors want for AWS compliance packets rather than a blog rewrite or a monitoring console export. Amazon CloudWatch provides metrics, logs, and alarms for operations; AWS Shield provides DDoS protection; neither is the compliance document library that city risk officers should cite for AWS attestations. Distractors fail when they send auditors to monitoring dashboards, DDoS services, or unrelated tooling for SOC-style reports and legal agreements. Exam caveat: Artifact supports the AWS side of shared responsibility evidence; municipal teams must still evidence their own IAM access reviews, encryption settings, network baselines, and application controls to satisfy assessors looking at the customer side. Operational check: grant Artifact access to security and compliance roles ahead of audit season, download current reports for services in the estate, store them in the city's GRC repository with clear version dates, train project managers not to claim Artifact alone certifies the application, and refresh downloads when reports rotate so questionnaires cite current packages.