Examkin

Question

Difficulty: HardShared Responsibility Model

A healthcare organization is preparing for an external audit to verify HIPAA compliance for its cloud-based medical records application. The application's architecture consists of Amazon Elastic Compute Cloud (Amazon EC2) instances behind an Application Load Balancer, with data stored in an Amazon Aurora MySQL database cluster. To satisfy the audit, the organization must provide documentation of physical data center security, evidence of guest operating system patch compliance, and proof of data-in-transit encryption. Under the AWS Shared Responsibility Model, which combination of actions is the customer responsible for performing to meet these requirements?

  1. A
    Retrieving compliance documentation from AWS Artifact, patching the underlying hypervisors hosting the Amazon EC2 instances, and configuring stateful Network Access Control Lists (Network ACLs) at the EC2 instance level.
  2. Retrieving AWS compliance reports from AWS Artifact, applying security patches to the guest operating system of the Amazon EC2 instances, and configuring SSL/TLS certificates on the Application Load Balancer.Answer
  3. C
    Submitting a support ticket to AWS to request physical data center access logs, applying operating system patches to the Amazon Aurora database instances, and enabling SSL/TLS on the Application Load Balancer.
  4. D
    Contacting the AWS Security team to request compliance certifications, applying operating system updates to both the Amazon EC2 and Amazon Aurora instances, and establishing stateless Security Groups for the EC2 instances.

Answer

The customer is responsible for retrieving AWS compliance reports from AWS Artifact, patching the guest operating system of the EC2 instances, and configuring SSL/TLS certificates on the Application Load Balancer.
The correct option outlines customer responsibilities: retrieving third-party compliance reports from the self-service AWS Artifact portal, patching the guest operating system of EC2 instances, and configuring SSL/TLS certificates on the Application Load Balancer. Under the AWS Shared Responsibility Model, AWS is responsible for security 'of' the cloud (physical data centers and the virtualization hypervisor layer), while the customer is responsible for security 'in' the cloud (guest operating systems, load balancer listener certificates, and network traffic protection).

Step-by-Step Solution

1
Determine the resource-specific patching boundary.
Patching the guest operating system of Amazon EC2 instances is a customer responsibility (IaaS), whereas patching the underlying operating system of Amazon Aurora instances and hypervisors is managed by AWS.
AWS manages physical and virtualization layers, as well as managed database platforms, while customers must secure their own guest OS configurations on IaaS.
2
Identify the proper tool and responsibility for physical security verification.
AWS is responsible for physical data center security. Customers verify this compliance by downloading reports from AWS Artifact, not by requesting raw logs from support or security teams.
AWS Artifact is the self-service portal that provides on-demand access to AWS security and compliance reports.
3
Clarify the network security configuration responsibilities.
Enabling SSL/TLS certificates on the Application Load Balancer is a customer task. Additionally, security groups are stateful and operate at the instance level, whereas Network ACLs are stateless and operate at the subnet level.
AWS provides the load balancing infrastructure, but configuring secure listeners and certificate mapping is an application-level customer responsibility.

Key Concept

AWS Shared Responsibility Model boundaries across IaaS, PaaS, and compliance tasks
Estimated Time:2m 0s
Rate this question

Topics

Shared Responsibility Model

More questions from this topic