SOA-C02 Question 191
Select 4A company headquartered in the European Union (EU) is planning to deploy a new application on AWS. The application will process and store sensitive customer data, and the organization is required to comply with GDPR regulations. As a SysOps Administrator, how should you validate the AWS Region and service selections to ensure compliance with GDPR?
- A
Choose an AWS Region located within the EU, such as Frankfurt or Ireland, to ensure data residency requirements are met.
- B
Verify the selected Region supports all the required AWS services for the application to function.
- C
Ensure that AWS offers GDPR-compliant services and sign the AWS GDPR Data Processing Addendum (DPA).
- D
Use any AWS Region globally, as AWS automatically ensures GDPR compliance for all services regardless of Region.
- E
Enable encryption for data at rest and in transit, as required by GDPR compliance.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
To comply with GDPR, the organization must ensure that sensitive customer data is processed and stored within an EU AWS Region (e.g., Frankfurt or Ireland) to meet data residency requirements. Additionally, the selected AWS Region must support all required services for the application's functionality. The organization must also sign AWS's GDPR Data Processing Addendum (DPA) and implement encryption for data at rest and in transit to meet GDPR security standards. Simply choosing any AWS Region globally does not guarantee GDPR compliance.
- A. Correct.
Choosing an AWS Region located within the EU ensures compliance with GDPR data residency requirements, which mandate that customer data must remain within the EU.
- B. Correct.
The selected Region must support all required AWS services to ensure the application's functionality and compliance with GDPR.
- C. Correct.
AWS provides GDPR-compliant services and offers a GDPR Data Processing Addendum (DPA) that organizations must sign to meet GDPR requirements.
- D. Incorrect.
This is incorrect because GDPR compliance is not automatically guaranteed across all Regions. Organizations must ensure compliance with GDPR by selecting Regions and services that meet specific regulatory requirements.
- E. Correct.
Enabling encryption for data at rest and in transit is a critical GDPR requirement to protect sensitive customer data and ensure compliance with security standards.