MLA-C01 Question 111
Select 3You are developing a machine learning model on AWS that processes sensitive customer data, including personally identifiable information (PII). Compliance requirements mandate that the data must not leave the European Union (EU). Which of the following steps should you take to ensure compliance with these requirements?
- A
Use Amazon S3 buckets configured with a bucket policy to enforce data residency within the EU.
- B
Enable server-side encryption on all S3 objects to secure data at rest.
- C
Ensure that AWS services used in the pipeline, such as Amazon SageMaker, are deployed in EU-based regions.
- D
Use AWS Key Management Service (KMS) with a custom key stored in an EU region to manage encryption keys.
- E
Transfer sensitive data to an on-premises server within the EU for processing instead of using AWS services.
Show answer and explanation
Correct answers: A, C, D
Explanation
To meet compliance requirements for data residency within the EU, it is necessary to configure AWS services and resources appropriately. This includes using S3 bucket policies to restrict data residency, deploying AWS services in EU-based regions, and managing encryption keys within the EU using AWS KMS. These steps ensure that data remains within the geographic boundary mandated by the compliance requirements while leveraging the capabilities of AWS services. Transferring data to on-premises servers is not required when AWS services are properly set up for compliance.
- A. Correct.
Using Amazon S3 bucket policies to enforce data residency ensures that the data remains within the EU, which is critical for meeting compliance requirements.
- B. Incorrect.
While enabling server-side encryption is a good security practice, it does not address the compliance requirement of ensuring the data remains within the EU.
- C. Correct.
Deploying AWS services such as Amazon SageMaker in EU-based regions ensures that the data processing and storage comply with the residency requirements.
- D. Correct.
Using AWS KMS with a custom key stored in an EU region ensures that encryption keys are also managed within the EU, meeting compliance regulations.
- E. Incorrect.
Transferring data to an on-premises server is unnecessary if AWS services are properly configured to meet compliance requirements. AWS offers compliant solutions for data residency requirements.