Examkin

Question

Difficulty: MediumShared Responsibility Model

A shipping logistics company is deploying its microservices-based application using containers on AWS Fargate. Under the AWS Shared Responsibility Model, which two security tasks are the responsibility of the customer? (Select TWO.)

  1. Configuring the security groups to control inbound and outbound traffic to the running container tasksAnswer
  2. Managing and patching the application code and libraries packaged inside the container imagesAnswer
  3. C
    Patching the underlying host operating system and virtualization hypervisor running the containers
  4. D
    Managing the physical infrastructure and hardware layer where the container tasks run
  5. E
    Retrieving the ISO 27001 compliance certificates for the Fargate host infrastructure using Amazon Inspector

Answer

Under the AWS Shared Responsibility Model for AWS Fargate, the customer is responsible for configuring security groups to control network traffic to the container tasks, and managing and patching the application code and libraries packaged inside the container images.
Under the AWS Shared Responsibility Model for managed container services like AWS Fargate, AWS handles the host operating system, virtualization layer, and physical infrastructure security. The customer retains control and responsibility for security 'in' the cloud, which includes configuring network access rules via security groups to restrict traffic to the containers, and managing the security of the container contents, including patching application code and dependencies.

Step-by-Step Solution

1
Analyze the service type in the scenario
AWS Fargate is a serverless compute engine for containers.
Understanding whether a service is IaaS, PaaS, or serverless/managed determines where the Shared Responsibility Model boundary lies.
2
Differentiate between AWS and customer responsibilities for Fargate
AWS manages the infrastructure layer (physical security, hardware, host OS, virtualization, container runtime). The customer manages the container contents (code, packages) and network access controls (security groups).
This establishes which tasks belong to each party under the model.
3
Evaluate the choices based on the established boundaries
Configuring security groups and patching application code/container images are customer responsibilities. Patching the host OS and managing physical hardware are AWS responsibilities. Accessing compliance documents is done via AWS Artifact, not Amazon Inspector.
This identifies the correct options and eliminates the incorrect distractors.

Key Concept

Shared Responsibility Model for Serverless Container Services (AWS Fargate)
Rate this question

Topics

Shared Responsibility Model

More questions from this topic