CLF-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS is HIPAA certified, meaning all AWS services automatically comply with HIPAA

  Why it's wrong here

  HIPAA is a US legal and regulatory framework, not a certification program, so no vendor can be 'HIPAA certified.' Instead, AWS provides a set of services that are designated as HIPAA-eligible, and AWS will sign a BAA only for those specific services. Even with that designation, a customer must still configure the services with appropriate controls and document its own compliance, because many AWS services are not on the HIPAA-eligible list at all.

• ✓

  AWS will sign a BAA for eligible services, and customers are responsible for configuring services to meet HIPAA requirements

  Why this is correct

  For HIPAA-eligible services, AWS will enter into a BAA with the customer, acknowledging responsibilities under the Shared Responsibility Model. Customers are then responsible for the 'security IN the cloud,' which includes configuring encryption, managing access with IAM roles and policies, enabling CloudTrail audit logging, and setting retention controls so that PHI is handled per HIPAA requirements. AWS is responsible for the physical and network infrastructure, but the customer's configuration determines whether the solution actually meets HIPAA standards.

• ✗

  PHI cannot be stored in the cloud because cloud environments are inherently non-compliant with HIPAA

  Why it's wrong here

  The belief that PHI cannot reside in a cloud environment is incorrect. AWS provides multiple HIPAA-eligible services, such as S3 with server-side encryption, RDS with Transparent Data Encryption, and CloudTrail for audit trails, that can legally store and process PHI when a BAA is in place and the customer follows required configurations. The cloud itself is not inherently non-compliant; compliance depends on how the system is architected, secured, and maintained by both the customer and AWS under the shared responsibility model.

• ✗

  HIPAA compliance is automatic once a BAA is signed with AWS

  Why it's wrong here

  Signing a BAA with AWS is a necessary first step, but it does not make a customer's environment HIPAA compliant by itself. HIPAA compliance is an ongoing operational outcome that requires customers to implement technical safeguards such as encrypting PHI at rest and in transit, enforcing strict IAM access controls, and maintaining audit logs. AWS secures the underlying infrastructure; the customer must still configure each service and manage its own processes, policies, and user activity to meet the HIPAA Privacy and Security Rules.

Go deeper

Related to this question