Examkin

Question

Difficulty: MediumShared Responsibility Model

A media streaming company is deploying a serverless image processing pipeline using AWS Lambda. Under the AWS Shared Responsibility Model, which of the following security tasks are the responsibility of the customer? (Select TWO.)

  1. Writing and securing the application code run within the Lambda functionsAnswer
  2. Managing the IAM execution roles and access policies assigned to the Lambda functionsAnswer
  3. C
    Patching the underlying operating system and runtime environments used by the Lambda functions
  4. D
    Managing physical security and environmental controls at the data centers hosting AWS Lambda
  5. E
    Configuring virtualization software and maintaining the physical hardware layer of the servers

Answer

The customer is responsible for writing and securing the application code run within the Lambda functions and managing the IAM execution roles and access policies assigned to the Lambda functions.
For serverless services like AWS Lambda, AWS manages the entire underlying execution environment, including the physical infrastructure, virtualization layer, operating system, and runtime. The customer retains control and responsibility for the application code written and deployed, as well as the Identity and Access Management (IAM) configurations, such as the execution roles that grant the function permissions to interact with other AWS resources.

Step-by-Step Solution

1
Identify the AWS service type in the scenario.
AWS Lambda is a serverless (managed) service.
The customer's responsibilities vary depending on whether the service is Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or Serverless.
2
Apply the Shared Responsibility Model boundaries for serverless services.
AWS manages the physical infrastructure, virtualization, host operating system, and runtime. The customer manages application code, data, and access configurations.
This determines which tasks belong to the customer ('security in the cloud') versus AWS ('security of the cloud').
3
Evaluate the choices against these boundaries.
Writing secure code and configuring IAM execution roles are customer responsibilities, whereas OS/runtime patching, physical security, and virtualization maintenance are AWS responsibilities.
This identifies the two correct customer-managed security actions.

Key Concept

Shared Responsibility Model for Serverless Services
Rate this question

Topics

Shared Responsibility Model

More questions from this topic