Examkin

Question

Difficulty: MediumShared Responsibility Model

A healthcare technology company is hosting its customer portal on AWS. The static frontend files are stored in an Amazon S3 bucket, and the backend application is exposed via Amazon API Gateway. Under the AWS Shared Responsibility Model, which of the following security tasks are the responsibility of the customer? (Select TWO.)

  1. Configuring bucket policies and access control lists (ACLs) to restrict access to the static web assetsAnswer
  2. Configuring API Gateway resource policies and authorization to control access to the backend APIsAnswer
  3. C
    Applying operating system patches to the servers running the Amazon S3 storage service
  4. D
    Managing the physical security and access controls of the data centers where the API Gateway is deployed
  5. E
    Ensuring the physical destruction of decommissioned hard drives that stored the patient data

Answer

The customer is responsible for configuring S3 bucket policies and access control lists (ACLs) to secure static web assets, as well as configuring API Gateway resource policies and authorization settings to control API access.
Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud, which includes managing identity and access management (IAM), data classification, and configuring resource-specific access controls. For Amazon S3, this entails setting up bucket policies and ACLs. For Amazon API Gateway, this involves establishing authorization methods and resource policies to control API invocation.

Step-by-Step Solution

1
Determine the AWS service models in use.
Amazon S3 and Amazon API Gateway are fully managed, abstract services.
Knowing the service type helps define the boundary between what AWS manages (underlying OS, virtualization, physical infrastructure) and what the customer configures.
2
Distinguish between security 'of' the cloud and security 'in' the cloud.
AWS handles OS patching, physical data center security, and hardware decommissioning. The customer must configure access controls, identity policies, and resource authorization.
This maps the responsibilities correctly according to the Shared Responsibility Model.
3
Select the options representing customer-managed configurations.
S3 bucket policies/ACLs and API Gateway authorization/resource policies are correct. Hardware and operating system tasks are incorrect.
Only access control configurations on these managed services fall under the customer's scope.

Key Concept

AWS Shared Responsibility Model
Estimated Time:1m 30s
Rate this question

Topics

Shared Responsibility Model

More questions from this topic