AIF-C01 Question 222
Select 3A company is implementing an AI/ML solution on AWS to analyze customer data for predictive insights. As part of their data governance strategy, they need to ensure compliance with data residency requirements, monitor data access activities, and define retention policies for the data. Which combination of AWS services and features would best address these requirements?
- A
AWS CloudTrail for logging and monitoring data access activities
- B
Amazon S3 Object Lock to enforce data retention policies
- C
AWS Glue to ensure compliance with data residency requirements
- D
AWS Config to track configuration changes to resources storing customer data
- E
AWS Control Tower for centralized data residency enforcement
Show answer and explanation
Correct answers: A, B, D
Explanation
The question focuses on data governance strategies, specifically data residency, monitoring, and retention. AWS CloudTrail is suitable for monitoring data access activities, Amazon S3 Object Lock enforces data retention policies, and AWS Config helps track configuration changes, which can assist in governance. AWS Glue and AWS Control Tower are not directly aligned with the specific requirements outlined in the scenario.
- A. Correct.
AWS CloudTrail provides logging and monitoring of API calls and user activities, which helps meet the requirement of monitoring data access activities.
- B. Correct.
Amazon S3 Object Lock enables you to enforce retention policies by preventing the deletion or modification of data for a specified period of time, addressing the data retention requirement.
- C. Incorrect.
AWS Glue is a data integration service primarily used for building ETL workflows. While it can transform and move data, it is not used for ensuring compliance with data residency requirements.
- D. Correct.
AWS Config tracks configuration changes to AWS resources, which can include resources storing customer data. This helps with monitoring compliance and governance requirements.
- E. Incorrect.
AWS Control Tower provides a framework for multi-account governance but does not specifically enforce data residency requirements. Data residency compliance depends on the location of the resources.