Examkin

Question

Difficulty: MediumShared Responsibility Model

A retail company deploys its online storefront using AWS Elastic Beanstalk. Under the AWS Shared Responsibility Model, which two of the following security-related tasks are the responsibility of the customer?

  1. Securing the application code and data uploaded to the environmentAnswer
  2. Configuring Identity and Access Management (IAM) user permissions for accessing the environmentAnswer
  3. C
    Applying security patches and updates to the guest operating system
  4. D
    Patching and updating the platform runtime environments, such as Java or Node.js
  5. E
    Performing physical security audits of the AWS data centers hosting the application

Answer

Securing the application code and data uploaded to the environment, and configuring Identity and Access Management (IAM) user permissions for accessing the environment.
In the Platform as a Service (PaaS) model represented by AWS Elastic Beanstalk, the customer is responsible for configuring access policies (IAM) and securing the application code and data they upload. AWS manages and maintains the infrastructure, virtualization layer, guest operating system, and the application runtime platform.

Step-by-Step Solution

1
Identify the service model of the AWS service described.
AWS Elastic Beanstalk is identified as a Platform as a Service (PaaS) model.
The shared responsibility boundary shifts depending on whether the service is Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or Software as a Service (SaaS).
2
Differentiate between the customer's responsibility and AWS's responsibility for a PaaS service.
AWS manages the guest operating system, platform patching (such as Java or Node.js runtimes), virtualization layer, and physical infrastructure. The customer remains responsible for application code, configuration settings, data security, and identity/access control.
This step determines which tasks fall under customer ownership ('security in the cloud') versus AWS ownership ('security of the cloud') for managed services.
3
Select the two customer responsibilities from the options provided.
The tasks of securing the application code and data, as well as configuring IAM permissions, are selected.
These match the customer's operational responsibilities in a Platform as a Service (PaaS) deployment.

Key Concept

Under the AWS Shared Responsibility Model, the division of labor depends on the type of service. For Platform as a Service (PaaS) offerings like AWS Elastic Beanstalk, AWS takes on more responsibility by managing the guest OS, runtime software, and physical security. The customer remains responsible for securing their code, protecting their data, and controlling user access via IAM.
Rate this question

Topics

Shared Responsibility Model

More questions from this topic