A county must show auditors HIPAA- and CJIS-aligned control evidence for workloads on AWS, including access to official compliance reports, while the architecture itself uses encryption and tight access controls. Which combination best aligns technologies to that compliance-evidence need?
Select an answer to reveal the explanation.
Short Explanation
Artifact is the county’s filing cabinet of AWS compliance paperwork; KMS and least privilege are how you actually build locks the paperwork describes. Renaming security groups “HIPAA-ready” without controls is theater.
Full Explanation
Counties that must show HIPAA- and CJIS-aligned control evidence for AWS workloads need two complementary pieces: AWS Artifact for official compliance reports and attestations from AWS, and a workload design that actually implements encryption with KMS plus least-privilege access controls supporting the control families those frameworks describe. Artifact fills the "what AWS asserts" filing cabinet; KMS, tight IAM, logging, and network controls fill the "what we built" binder auditors also demand.
Claiming compliance solely by renaming security groups to HIPAA-ready without encryption or evidence artifacts fails both substance and documentation. Publishing protected health information to a public S3 website to "demonstrate transparency" fails confidentiality catastrophically. Disabling CloudTrail and KMS because auditors prefer fewer logs fails auditability and encryption requirements those programs emphasize.
Exam caveat: Artifact reports do not automatically make a customer environment compliant; shared responsibility means the city still designs encryption, access, logging, and operational procedures. Operational check: download relevant Artifact reports for the services in use, map each control family to concrete settings (CMKs, IAM boundaries, CloudTrail orgs trails), and run an access review proving non-authorized roles cannot read regulated datasets.