CLF-C02 Cloud Technology and Services Practice Question
A company stores customer health records in an application database and needs a HIPAA-eligible AWS service for the database tier. Which relational database option on AWS is eligible for HIPAA workloads?
⚠ Common exam trap
Watch out — candidates often assume RDS is automatically HIPAA-compliant (Option A) or that only self-managed EC2 databases qualify (Option D), when in fact the critical missing piece is the signed Business Associate Agreement (BAA) with AWS, which is a contractual prerequisite for any HIPAA-eligible service.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon RDS with a signed Business Associate Agreement (BAA) with AWS
Amazon RDS can be used for HIPAA workloads when the customer has signed a Business Associate Agreement (BAA) with AWS and configures the RDS instance with encryption at rest (using AWS KMS) and encryption in transit (using TLS). The BAA is a contractual requirement under HIPAA that makes AWS a business associate, allowing covered entities to store protected health information (PHI) in RDS. Without a signed BAA, no AWS service is automatically HIPAA-eligible, even if technical security controls are in place.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon RDS requires no special configuration for HIPAA compliance
Why it's wrong here
Amazon RDS is a HIPAA-eligible service, but eligibility does not mean automatic compliance. To lawfully process protected health information (PHI), the customer must first sign a Business Associate Agreement (BAA) with AWS and then configure RDS appropriately—for example, enabling encryption at rest with AWS KMS, enforcing TLS for data in transit, controlling access through IAM and security groups, and enabling audit logging. If these safeguards are not in place, an RDS deployment can still be non-compliant.
- ✓
Amazon RDS with a signed Business Associate Agreement (BAA) with AWS
Why this is correct
Using Amazon RDS for HIPAA workloads is valid when the customer has signed a Business Associate Agreement with AWS and configures the service according to AWS's HIPAA implementation guidance. The BAA extends AWS's business associate commitments to the customer, and RDS is listed in the AWS HIPAA Eligible Services Reference, so it can store protected health information. After signing, the customer must still implement encryption via KMS, least-privilege IAM policies, VPC-based network controls, and database audit logging to satisfy the HIPAA Security Rule.
- ✗
Amazon Redshift only, because RDS does not support HIPAA workloads
Why it's wrong here
This option incorrectly claims Amazon Redshift is the only HIPAA-eligible database service and that RDS cannot support HIPAA workloads. In reality, the AWS HIPAA Eligible Services Reference lists both Redshift and RDS, along with Aurora and DynamoDB, as services that can handle protected health information when a BAA is in place and appropriate configurations are applied. Redshift is designed for analytics and data warehousing rather than online transaction processing, so it is not a replacement for RDS in a typical PHI-containing application.
- ✗
Only self-managed databases on EC2 can be used for HIPAA workloads on AWS
Why it's wrong here
AWS does not force customers to run their own databases on EC2 to handle protected health information; many managed services are HIPAA-eligible. Amazon RDS, Aurora, DynamoDB, and Redshift appear in the AWS HIPAA Eligible Services Reference, so customers can rely on these managed services after signing a BAA and enabling required security controls. A self-managed EC2 database places more operational responsibility on the customer, but it is only one of several valid architectural options, not the sole approach.
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.