Your department is in charge of developing an Ecommerce website where customers can browse and purchase products online. The application is developed in the AWS platform. A wide range of AWS services is used, including EC2, Lambda, CloudFormation, etc. Recently, internal security auditors asked you to provide a document to state that the related AWS services meet the Payment Card Industry (PCI) compliance. How should you provide the document?

Answer options:

A.Download IAM Credential Report about Payment Card Industry (PCI) and provide it to auditors.
B.Submit a request to AWS support and ask for the Payment Card Industry (PCI) compliance document.
C.In AWS Config Resource Inventory, download the PCI compliance document and present it to auditors.
D.Download Payment Card Industry (PCI) compliance document from AWS Artifact and provide it to auditors.

Answer: D
Option A is incorrect because IAM Credential Report only contains IAM user information, and it does not provide evidence for being PCI compliant.
Option B is incorrect because users do not need to contact AWS support for this task as they can themselves get the reports from AWS Console using the Artifact service.
Option C is incorrect because AWS Config Resource Inventory cannot provide documents & reports for being PCI compliant.
Option D is CORRECT because AWS Artifact provides a report and details on how your AWS infrastructure & services being used on your account are PCI compliant and helps validate the implementation and operating effectiveness of AWS security controls.
For more information on AWS Artifact, kindly refer to the below URL:
https://aws.amazon.com/artifact/