SCS-C02 Question 389
Select 2Your organization operates in the healthcare industry and must comply with HIPAA regulations regarding data retention. You are tasked with designing a solution in AWS to store patient records for a minimum of 6 years. Which of the following solutions ensure compliance with this data retention requirement while maintaining security and cost-efficiency?
- A
Use Amazon S3 with a bucket policy that enforces a 6-year lifecycle retention period and enables versioning.
- B
Store patient records in Amazon S3 Glacier Deep Archive, configure a vault lock policy to enforce retention for 6 years, and enable access logging.
- C
Use Amazon RDS with automated backups enabled and set the backup retention period to 6 years.
- D
Store patient records in Amazon DynamoDB and enable Point-in-Time Recovery (PITR) for 6 years.
- E
Use Amazon S3 Intelligent-Tiering with a bucket policy for lifecycle management and enable server-side encryption (SSE).
Show answer and explanation
Correct answers: A, B
Explanation
To comply with HIPAA's data retention requirements of 6 years, a solution must ensure both security and the enforcement of retention policies. Amazon S3 with versioning and bucket policies or Amazon S3 Glacier Deep Archive with vault lock policies are optimal choices. They provide cost-efficient, long-term storage and enforce retention periods, meeting compliance standards. Other options either lack the ability to enforce such lengthy retention or are not cost-effective for archival purposes.
- A. Correct.
Correct: Using Amazon S3 with bucket policies, versioning, and lifecycle rules ensures that objects are retained for the required duration, and versioning provides additional protection against accidental deletions. This approach is compliant with HIPAA.
- B. Correct.
Correct: Amazon S3 Glacier Deep Archive is a cost-effective solution for long-term data storage. Configuring a vault lock policy enforces the required retention period, and access logging provides an audit trail for compliance.
- C. Incorrect.
Incorrect: Amazon RDS automated backups have a maximum retention period of 35 days and cannot meet the 6-year requirement. This makes it unsuitable for long-term retention needs.
- D. Incorrect.
Incorrect: While DynamoDB with Point-in-Time Recovery (PITR) provides continuous backups, it is not designed for enforcing long-term retention policies like 6 years, nor is it cost-effective for large amounts of archival data.
- E. Incorrect.
Incorrect: Although S3 Intelligent-Tiering optimizes costs for infrequent access and server-side encryption ensures data security, lifecycle management alone does not enforce retention compliance for a fixed period such as 6 years.