ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

The company remains the data controller under GDPR and must keep the personal data inside the European Economic Area unless additional transfer safeguards are in place. Using only EU Regions such as eu-central-1 or eu-west-1 meets data-residency expectations. Encrypting the data with customer-managed AWS KMS keys that are also restricted to those Regions safeguards confidentiality and allows the controller to delete the keys later, which renders the data permanently unreadable and can fulfil the GDPR right to erasure. AWS acts as the data processor, and its GDPR Data Processing Addendum is automatically part of the AWS Service Terms, so no separate signature is required (although the customer can request a signed copy). The other options either move data outside the EU, rely on an invalid transfer mechanism, prevent deletion with Object Lock Compliance mode, or incorrectly shift the controller role to AWS, so they fail to meet GDPR obligations.