Examkin

Question

Difficulty: HardShared Responsibility Model

A media streaming company is deploying a containerized microservice using Amazon Elastic Container Service (Amazon ECS) with the AWS Fargate launch type. The security team needs to define the operational boundaries between the company and AWS to ensure compliance. Which of the following operational tasks is the sole responsibility of the customer under the AWS Shared Responsibility Model for this architecture?

  1. A
    Installing security updates and operating system patches on the physical host servers hosting the virtualization hypervisors
  2. Patching vulnerabilities within the application code and software packages packaged inside the container imageAnswer
  3. C
    Configuring stateless security groups at the task level to automatically track and permit return traffic for outbound requests
  4. D
    Obtaining custom physical security audits of the AWS edge locations directly from AWS security personnel for third-party compliance certification

Answer

Patching vulnerabilities within the application code and software packages packaged inside the container image
Under the AWS Shared Responsibility Model, AWS Fargate is a serverless compute engine for containers. Because the customer does not manage the underlying virtual servers or host operating systems, AWS is responsible for patching and securing the hypervisor and hosts. However, the customer is responsible for the container image itself, which includes patching the application code, runtimes, and dependencies packaged inside the image.

Step-by-Step Solution

1
Analyze the deployment model and AWS service in use.
The application runs on Amazon ECS using the AWS Fargate launch type, which is a serverless container environment.
Establishing the platform type defines the Shared Responsibility Model boundary; serverless container services shift host management and patching to AWS.
2
Differentiate between the responsibilities of AWS and the customer for serverless container layers.
AWS secures the infrastructure, physical hosts, and hypervisors. The customer remains responsible for everything packaged inside the container image (application code, runtimes, packages) as well as access configurations (IAM roles, security groups).
This separation determines which operations the customer must perform to keep the containerized workload secure.
3
Identify the option that represents a valid, correct customer responsibility.
Securing and patching application code and libraries packaged inside the container image is the customer's responsibility. The other options are managed by AWS, conceptually incorrect, or violate policy.
Validates the correct answer and confirms the distractors are incorrect based on the model boundary.

Key Concept

AWS Shared Responsibility Model applied to serverless container services (AWS Fargate)
Estimated Time:1m 30s
Rate this question

Topics

Shared Responsibility Model

More questions from this topic