Examkin

Question

Difficulty: HardShared Responsibility Model

A software development team is building a serverless, event-driven web application. The architecture utilizes AWS Lambda to run the backend application code and Amazon DynamoDB as the database layer. According to the AWS Shared Responsibility Model, which of the following operational tasks are the sole responsibility of the customer? (Select TWO.)

  1. Configuring IAM roles to establish fine-grained permissions for the Lambda function to interact with the DynamoDB tableAnswer
  2. Writing secure application logic and managing the software dependencies of the package uploaded to AWS LambdaAnswer
  3. C
    Applying operating system patches and runtime updates to the underlying virtualization layer hosting the Lambda function
  4. D
    Defining stateless Network Access Control Lists (NACLs) at the subnet level to isolate individual Lambda execution environments
  5. E
    Retrieving physical security logs of AWS data centers to manually upload them to AWS Artifact for compliance verification

Answer

Configuring IAM roles to establish fine-grained permissions and securing custom application code along with its dependencies.
Under the AWS Shared Responsibility Model for serverless services like AWS Lambda, AWS manages the underlying physical infrastructure, virtualization layer, and operating system. The customer is responsible for securing their own application code, including dependencies, and configuring identity and access management (IAM) permissions to control access between resources (such as Lambda and DynamoDB).

Step-by-Step Solution

1
Analyze the service types used in the scenario.
AWS Lambda and Amazon DynamoDB are classified as managed/serverless (abstracted) services.
The division of responsibility shifts more operational tasks to AWS when using serverless services compared to Infrastructure as a Service (IaaS) like Amazon EC2.
2
Differentiate between customer and AWS responsibilities for serverless compute and database layers.
AWS handles physical security, infrastructure, operating systems, virtualization, and runtime environment updates. The customer handles data classification, IAM permissions, configuration settings, and application code/dependencies.
This establishes the logical boundary of the Shared Responsibility Model for serverless architectures.
3
Evaluate the choices against common misconceptions regarding VPC networks and compliance tooling.
Exclude operating system patching (AWS responsibility), subnet NACL isolation for Lambda containers (managed by AWS), and uploading logs to AWS Artifact (misunderstanding of AWS Artifact's pull-only nature). Identify code security and IAM configuration as customer responsibilities.
This isolates the correct options and maps the incorrect distractors to specific cloud security misconceptions.

Key Concept

Shared Responsibility Model for Serverless Services
Rate this question

Topics

Shared Responsibility Model

More questions from this topic