MLA-C01 Question 110
Select 4You are building a machine learning model using Amazon SageMaker to process sensitive healthcare data that includes Protected Health Information (PHI). Your organization operates in a region with strict data residency laws that require all data to remain within the country. What steps should you take to ensure compliance with these requirements?
- A
Enable encryption at rest and in transit for all data processed by your SageMaker model.
- B
Use an Amazon S3 bucket located in the same region as your organization to store the data.
- C
Rely on default SageMaker configurations without making any additional changes to the setup.
- D
Ensure the SageMaker notebook instance and training jobs are launched in the same region where the data resides.
- E
Use AWS Key Management Service (KMS) to manage encryption keys for sensitive data.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
To comply with both data residency laws and sensitive data regulations (e.g., PHI), you must ensure that data is stored, processed, and managed securely within the same region. This includes enabling encryption, using region-specific storage and compute resources, and managing encryption keys effectively using AWS KMS. Default configurations alone may not meet compliance requirements.
- A. Correct.
Encryption is critical for protecting sensitive data like PHI. Enabling encryption both at rest and in transit ensures that the data remains secure during storage and transfer.
- B. Correct.
Storing data in an Amazon S3 bucket in the same region is necessary to comply with data residency laws, which require data to remain within the country or specific geographical boundaries.
- C. Incorrect.
Relying solely on default configurations may not ensure compliance, as additional configurations like encryption and region-specific setups might be required for sensitive data.
- D. Correct.
Launching SageMaker resources in the same region as the data ensures compliance with data residency regulations and avoids unnecessary cross-regional data transfers.
- E. Correct.
Using AWS Key Management Service (KMS) allows you to manage and control encryption keys, providing an additional layer of security for sensitive data like PHI.