Examkin

Question

Difficulty: MediumData Protection and Encryption

A logistics company is migrating its supply chain management system to AWS. The system will store shipment records in Amazon S3 and database backups on Amazon EBS volumes. The company's security policy requires all data to be encrypted at rest and in transit. According to the AWS Shared Responsibility Model, which of the following security actions are the responsibility of the customer? (Select TWO.)

  1. Enabling server-side encryption (SSE) on Amazon S3 bucketsAnswer
  2. Configuring SSL/TLS certificates on Application Load Balancers for data in transitAnswer
  3. C
    Destroying decommissioned physical hard drives that stored application data
  4. D
    Managing physical access and maintenance of the hardware security modules (HSMs) used by AWS KMS
  5. E
    Upgrading the firmware of physical host servers that support the cloud infrastructure

Answer

Under the AWS Shared Responsibility Model, the customer is responsible for configuring encryption configurations such as enabling server-side encryption on Amazon S3 buckets and configuring SSL/TLS certificates on Application Load Balancers.
Under the AWS Shared Responsibility Model, the customer is responsible for security configurations 'in the cloud'. Enabling server-side encryption on Amazon S3 buckets protects data at rest by letting customers choose key management options. Configuring SSL/TLS certificates on Application Load Balancers manages the encryption of traffic in transit to the customer application. Both actions are customer responsibilities.

Step-by-Step Solution

1
Analyze the requirements for data protection in transit and at rest under the AWS Shared Responsibility Model.
Identify that configuring encryption (both at rest using S3 bucket encryption and in transit using SSL/TLS) are settings managed by the customer within the cloud.
This establishes customer responsibility for logical security configurations.
2
Evaluate the remaining tasks related to physical infrastructure, hardware decommissioning, and hypervisor/firmware maintenance.
Identify that AWS is responsible for physical security, physical hardware lifecycle (such as destroying decommissioned drives), and physical host maintenance.
This distinguishes between 'security in the cloud' (customer) and 'security of the cloud' (AWS).

Key Concept

AWS Shared Responsibility Model for Data Protection and Encryption
Estimated Time:1m 30s
Rate this question

Topics

Data Protection and Encryption

More questions from this topic