Examkin

Question

Difficulty: EasyData Protection and Encryption

A company is implementing a data protection policy for its applications running on AWS. The security team needs to understand the division of responsibility for data protection under the AWS Shared Responsibility Model.

Which of the following are responsibilities of the customer? (Select TWO.)

  1. Encrypting customer data at rest within AWS storage servicesAnswer
  2. B
    Managing the physical security of the host virtualization layer
  3. Configuring SSL/TLS for encrypting data in transitAnswer
  4. D
    Disposing of decommissioned physical hard drives
  5. E
    Maintaining the physical facilities and data center security

Answer

Under the AWS Shared Responsibility Model, the customer is responsible for encrypting customer data at rest within AWS storage services and configuring SSL/TLS for encrypting data in transit.
Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud. This includes protecting their own data, which requires them to configure encryption at rest within AWS storage services and establish SSL/TLS encryption for data in transit.

Step-by-Step Solution

1
Differentiate between security 'of' the cloud and security 'in' the cloud.
AWS manages security of the cloud (infrastructure, hardware, physical security). The customer manages security in the cloud (data, configurations, access control).
This division defines the boundary of responsibilities under the AWS Shared Responsibility Model.
2
Classify the given options into customer or AWS responsibilities.
Encrypting data at rest and configuring SSL/TLS for data in transit are security configurations within the customer's guest environment. Physical security and hardware disposal are infrastructure tasks managed by AWS.
Identifying who controls the configuration helps correctly attribute the responsibility.

Key Concept

Under the AWS Shared Responsibility Model, AWS is responsible for protecting the infrastructure that runs all of the services offered in the AWS Cloud. The customer is responsible for managing their data (including encryption options), classified as security 'in' the cloud.
Rate this question

Topics

Data Protection and Encryption

More questions from this topic