Examkin

Question

Difficulty: MediumShared Responsibility Model

A financial organization is deploying a microservices-based application using Amazon Elastic Container Service (Amazon ECS) on AWS Fargate. Under the AWS Shared Responsibility Model, which of the following are responsibilities of the customer? (Select TWO.)

  1. Configuring security group rules to control inbound and outbound network traffic to the containerized servicesAnswer
  2. Defining Identity and Access Management (IAM) task roles to restrict what AWS resources the containerized applications can accessAnswer
  3. C
    Patching the operating system hosting the container runtime daemon
  4. D
    Replacing faulty physical servers that support the container infrastructure
  5. E
    Maintaining the virtualization layer that isolates container tasks

Answer

The customer is responsible for configuring security group rules to control network traffic and defining IAM task roles to restrict container access to AWS resources.
Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud. When using AWS Fargate, this includes defining IAM task roles to govern application-level access to other AWS resources, and configuring security group rules to control inbound and outbound network traffic to the containerized service.

Step-by-Step Solution

1
Identify the AWS service and its deployment model.
Amazon ECS on AWS Fargate is identified as a serverless container service.
The service model dictates the boundary of responsibility. Fargate shifts host management responsibilities to AWS.
2
Differentiate between infrastructure security and configuration security.
Infrastructure security (physical security, host OS patching, hypervisor management) belongs to AWS. Configuration security (IAM, network access rules, application configuration) belongs to the customer.
This determines which duties are classified as security 'of' the cloud versus security 'in' the cloud.
3
Select the operations that correspond to customer configurations.
Configuring security groups and setting up IAM task roles are selected.
These tasks involve configuring access permissions and network security rules for the customer's specific workloads.

Key Concept

Shared Responsibility Model
Estimated Time:1m 30s
Rate this question

Topics

Shared Responsibility Model

More questions from this topic