Examkin

Question

Difficulty: MediumShared Responsibility Model

A fintech startup is deploying a public-facing REST API using Amazon API Gateway to expose financial transaction data. The API must be secured against unauthorized access, and all data transit must be encrypted. Under the AWS Shared Responsibility Model, which of the following tasks is the sole responsibility of the customer?

  1. Configuring access control and authorization using Amazon Cognito user pools or custom Lambda authorizersAnswer
  2. B
    Applying operating system and security patches to the underlying compute instances hosting API Gateway
  3. C
    Creating stateful Security Groups directly on the API Gateway endpoints to block malicious traffic at the network level
  4. D
    Conducting physical audits of the AWS data centers to verify compliance with financial industry standards

Answer

Configuring access control and authorization using Amazon Cognito user pools or custom Lambda authorizers
Configuring access control and authorization using Amazon Cognito user pools or custom Lambda authorizers is the correct answer because managing identity and access management (IAM) permissions, authentication, and authorization policies for the application's APIs falls under the customer's responsibility for securing their data 'in' the cloud.

Step-by-Step Solution

1
Identify the AWS service type in the scenario.
Amazon API Gateway is a fully managed (Platform-as-a-Service/Serverless) AWS service.
Managed services shift infrastructure-level maintenance tasks from the customer to AWS.
2
Differentiate between security 'of' the cloud and security 'in' the cloud for a managed service.
AWS handles the physical security, underlying operating systems, and patching. The customer remains responsible for securing data, configuring resource policies, and managing user access.
This determines which task the customer must execute directly to secure their API.
3
Evaluate the choices to find the customer-managed task.
Configuring user pools or Lambda authorizers controls access to the application data, which is 'in' the cloud and thus the customer's responsibility.
API access control is managed at the application layer by the customer.

Key Concept

Under the AWS Shared Responsibility Model, for managed services like Amazon API Gateway, AWS handles physical security, OS patching, and network infrastructure, while the customer is responsible for application-level security, including client-side encryption, access control (authentication/authorization), and resource configuration.
Rate this question

Topics

Shared Responsibility Model

More questions from this topic