CLF-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  SOC 2 Type II

  Why it's wrong here

  SOC 2 Type II is an attestation report that evaluates a service organization's controls relevant to security, availability, processing integrity, confidentiality, and privacy. While AWS is SOC 2 compliant, this framework is not the standard specifically designed for payment card data security; PCI DSS is the industry-mandated standard that directly governs how cardholder data must be protected during storage, processing, and transmission.

• ✓

  PCI DSS Level 1 compliance

  Why this is correct

  AWS maintains PCI DSS Level 1 compliance, which is the highest level of validation required by the Payment Card Industry Security Standards Council for service providers handling large volumes of transactions. This means AWS's infrastructure and services have undergone rigorous annual assessments and continuous monitoring to meet all PCI DSS requirements. Customers can download AWS's Attestation of Compliance directly from AWS Artifact to support their own PCI compliance obligations under the shared responsibility model.

• ✗

  HIPAA compliance

  Why it's wrong here

  HIPAA compliance applies to the protection of protected health information (PHI) for covered entities like healthcare providers and health plans. Although AWS offers HIPAA-eligible services and Business Associate Agreements, the question specifically addresses a company that needs to be certified for handling payment card data, which falls under PCI DSS, not HIPAA. HIPAA and PCI DSS are separate regulatory frameworks with distinct scopes and controls, so HIPAA compliance would not satisfy a payment card security requirement.

• ✗

  ISO 27001 certification

  Why it's wrong here

  ISO 27001 is a broad international standard for establishing, implementing, and continually improving an information security management system (ISMS). It focuses on overall organizational security posture, not on the specific technical and operational requirements for safeguarding cardholder data mandated by PCI DSS. While ISO 27001 certification is valuable for general security, it does not replace the need for PCI DSS compliance, which includes unique requirements such as network segmentation, cardholder data encryption, and vulnerability management specifically tied to payment card environments.

Go deeper

Related to this question