Examkin

Question

Difficulty: EasyShared Responsibility Model

A company stores its financial documents in an Amazon Simple Storage Service (Amazon S3) bucket. Under the AWS Shared Responsibility Model, which two of the following tasks are the responsibility of the customer? (Select TWO.)

  1. Enabling server-side encryption on the bucket to protect data at restAnswer
  2. Configuring Amazon S3 bucket policies to restrict access to authorized identitiesAnswer
  3. C
    Replacing faulty physical storage drives within the AWS data centers
  4. D
    Upgrading the underlying operating system of the physical servers hosting Amazon S3
  5. E
    Contacting the AWS security team directly to request physical data center access audit logs

Answer

The customer is responsible for enabling server-side encryption on the bucket and configuring S3 bucket policies to restrict access.
Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud. For Amazon S3, this includes managing data encryption configurations (such as enabling server-side encryption) and controlling access to buckets and objects (such as setting up bucket policies and IAM controls).

Step-by-Step Solution

1
Identify the AWS service type and its place in the Shared Responsibility Model.
Amazon S3 is a managed service (Platform-as-a-Service/Object storage), meaning AWS manages the infrastructure, operating system, and hardware, while the customer manages data classification, encryption, and access permissions.
Understanding the boundary between infrastructure management and data configuration helps isolate customer-managed tasks.
2
Analyze each option to determine whether it involves configuring customer data/access or managing physical infrastructure/compliance documents.
Configuring access policies and enabling data encryption are customer configurations (security 'in' the cloud). Managing server hardware, patching physical operating systems, and retrieving physical logs are AWS infrastructure responsibilities.
This isolates the correct options from the distractors based on the security 'in' the cloud versus security 'of' the cloud principle.

Key Concept

Under the AWS Shared Responsibility Model, for managed services like Amazon S3, AWS manages the security 'of' the cloud (physical infrastructure, virtualization layer, operating system), while the customer manages security 'in' the cloud (data encryption, access control policies).
Estimated Time:1m 0s
Rate this question

Topics

Shared Responsibility Model

More questions from this topic