Examkin

Question

Difficulty: HardShared Responsibility Model

A financial technology startup is developing a mobile payment application and decides to use Amazon Cognito User Pools for user identity management and authentication. Under the AWS Shared Responsibility Model, which of the following security tasks are the responsibility of the customer? (Select TWO).

  1. Defining password strength requirements and enabling multi-factor authentication (MFA) configurations for the user poolAnswer
  2. B
    Patching the underlying operating system and software stack of the directory servers hosting the user pool
  3. Configuring the app client settings and securing the client secrets used by the mobile application to interact with the user poolAnswer
  4. D
    Securing the physical infrastructure and hardware components of the facilities where the user credentials are encrypted and stored
  5. E
    Managing the database replication and automated failover processes for the Cognito directory store across multiple Availability Zones

Answer

Defining password strength requirements and enabling multi-factor authentication (MFA) configurations for the user pool, and configuring the app client settings and securing the client secrets used by the mobile application to interact with the user pool.
Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud. For a managed service like Amazon Cognito, this includes configuring security controls such as password policies, enabling multi-factor authentication (MFA), setting up app client credentials, and protecting application-side secrets. AWS handles the security 'of' the cloud, which includes physical host security, OS patching, database management, and service availability.

Step-by-Step Solution

1
Analyze the service model of Amazon Cognito.
Amazon Cognito is classified as a managed platform service. For managed services, AWS takes care of the underlying infrastructure, operating system, and platform layer, while the customer remains responsible for configuration, data classification, and access management.
Understanding the service type (IaaS vs. PaaS/Managed) is the first step in delineating responsibilities in the Shared Responsibility Model.
2
Evaluate the customer-side responsibilities for Amazon Cognito.
The customer controls identity policy definitions (e.g., password strength, MFA enforcement) and user access parameters. Additionally, because the client application integrates with Cognito, securing the client credentials/secrets and configuring these integration clients falls on the customer.
Configuring security settings inside the service and securing customer-facing application integration are aspects of security 'in' the cloud.
3
Evaluate the AWS-side responsibilities for Amazon Cognito.
AWS handles physical security of the storage facilities, operating system updates for the servers running Cognito, and the database persistence/replication layer.
Infrastructure tasks, hardware maintenance, and physical security belong to security 'of' the cloud, handled by AWS.

Key Concept

Shared Responsibility Model for Managed Services
Rate this question

Topics

Shared Responsibility Model

More questions from this topic