Examkin

Question

Difficulty: MediumShared Responsibility Model

A healthcare analytics company is migrating its data warehousing workloads to Amazon Redshift to perform complex queries on patient data. According to the AWS Shared Responsibility Model, which two of the following security and operational tasks are the responsibility of the customer?

  1. Managing database user accounts, cluster-level security groups, and database-level permissionsAnswer
  2. Enabling encryption at rest for the data warehouse using customer-managed keys in AWS Key Management Service (AWS KMS)Answer
  3. C
    Patching and upgrading the operating system of the underlying Redshift cluster nodes
  4. D
    Maintaining physical security and environmental controls in the AWS data centers hosting the cluster
  5. E
    Configuring stateless Network Access Control Lists (NACLs) to manage traffic between individual nodes inside the cluster

Answer

Managing database user accounts, cluster-level security groups, and database-level permissions; Enabling encryption at rest for the data warehouse using customer-managed keys in AWS Key Management Service (AWS KMS)
Under the AWS Shared Responsibility Model for managed services like Amazon Redshift, the customer is responsible for security 'in' the cloud, which includes managing database user access, permissions, cluster security groups, and data protection settings such as enabling encryption at rest using AWS Key Management Service (AWS KMS) keys.

Step-by-Step Solution

1
Identify the AWS service type and deployment model.
Amazon Redshift is a fully managed data warehouse service (PaaS/managed database), which automatically abstracts the physical hosting and operating system layers from the customer.
Understanding the service type determines where the boundary lies between customer and AWS responsibilities under the Shared Responsibility Model.
2
Evaluate the customer-side responsibilities (security 'in' the cloud) for managed database services.
The customer controls identity and access management (creating database users, granting permissions) and configurations like cluster-level security groups and database encryption using customer-managed keys.
Even in managed services, data security, authorization, and firewall rules at the service level remain customer duties.
3
Evaluate the AWS-side responsibilities (security 'of' the cloud) and filter out incorrect options.
AWS handles OS patching, hardware replacement, and physical security. Thus, managing physical data centers, patching cluster node operating systems, and configuring internal cluster networking are AWS responsibilities.
AWS manages the infrastructure layer for all cloud deployments, particularly for managed and containerized services.

Key Concept

Shared Responsibility Model for Managed Services
Rate this question

Topics

Shared Responsibility Model

More questions from this topic