Examkin

Question

Difficulty: MediumShared Responsibility Model

A startup is deploying a new serverless application using AWS Lambda to process user uploads. In accordance with the AWS Shared Responsibility Model, which of the following tasks is the responsibility of the startup?

  1. A
    Maintaining and updating the supported language runtime versions (e.g., Python or Node.js) provided by AWS.
  2. Defining the IAM execution roles and resource-based policies that control access to the Lambda functions.Answer
  3. C
    Applying security patches and updates to the guest operating system running the Lambda function.
  4. D
    Scheduling physical compliance audits and inspections of the AWS facilities hosting the serverless infrastructure.

Answer

Defining the IAM execution roles and resource-based policies that control access to the Lambda functions.
Defining IAM execution roles and resource-based policies is a customer responsibility. Under the Shared Responsibility Model, even for fully managed and serverless services like AWS Lambda, the customer retains control over identity and access management (IAM). This ensures that only authorized entities can invoke the functions and that the functions themselves have the minimum necessary privileges to access other AWS services.

Step-by-Step Solution

1
Analyze the service model type for the resource mentioned in the scenario.
AWS Lambda is a serverless (Function-as-a-Service / PaaS) offering where the underlying physical servers, virtualization hypervisors, operating systems, and runtimes are fully managed by AWS.
Determining the service type helps establish the boundary of responsibility between AWS and the customer.
2
Evaluate the customer's security responsibilities for serverless services.
The customer remains responsible for application code, data, and access management (IAM configuration, function execution roles, and resource policies).
This identifies the specific tasks the startup must perform to secure the application.
3
Select the option that represents a customer responsibility under IAM and access control.
Defining the IAM execution roles and resource-based policies falls directly under customer security configuration.
It aligns with the identity and access management requirements of the Shared Responsibility Model.

Key Concept

Under the AWS Shared Responsibility Model, serverless services like AWS Lambda shift infrastructure management responsibilities (like operating system patching and runtime maintenance) to AWS. The customer remains responsible for application code, data classification, and access management (Identity and Access Management, policies, and roles).
Rate this question

Topics

Shared Responsibility Model

More questions from this topic