Examkin

Question

Difficulty: HardShared Responsibility Model

A financial analytics firm is deploying a containerized API using Amazon Elastic Container Service (Amazon ECS) with the AWS Fargate launch type. The security team must define the security controls for which they are solely responsible. Under the AWS Shared Responsibility Model, which of the following operational tasks is the responsibility of the customer for this deployment?

  1. Configuring security groups to restrict traffic to the individual tasks and managing task execution IAM rolesAnswer
  2. B
    Patching and maintaining the guest operating system of the container instances hosting the ECS tasks
  3. C
    Managing isolation between concurrent container tasks sharing the same physical hardware resources
  4. D
    Configuring stateless network access control lists at the physical router level to protect the Availability Zones

Answer

Configuring security groups to restrict traffic to the individual tasks and managing task execution IAM roles
Under the AWS Shared Responsibility Model for AWS Fargate, the customer does not manage or access the underlying EC2 instances or host operating system. The customer is responsible for configuring application-level security, which includes security groups applied directly to the container tasks, and managing task-related access policies using IAM roles.

Step-by-Step Solution

1
Analyze the service type in the scenario
The deployment uses Amazon ECS with the AWS Fargate launch type, which is an abstraction layer (managed serverless container service).
Identifying Fargate as a managed/serverless service shifts the underlying host and infrastructure responsibilities from the customer to AWS.
2
Determine the boundary of customer responsibilities for AWS Fargate
The customer is responsible for container definitions, task execution IAM roles, application security groups, application code, data encryption, and identity management.
Since the customer does not have access to the underlying EC2 instances in Fargate, host-level management, host patching, and virtualization security are managed by AWS.
3
Evaluate the options against this boundary
The option to configure task-level security groups and IAM roles is a customer responsibility, while patching host operating systems, managing physical infrastructure isolation, and securing physical networks are AWS responsibilities.
Allows selecting the correct customer task and discarding AWS-managed tasks.

Key Concept

AWS Shared Responsibility Model for Container/Serverless Services (AWS Fargate)
Rate this question

Topics

Shared Responsibility Model

More questions from this topic