Examkin

Question

Difficulty: Very hardShared Responsibility Model

A financial services company is migrating a multi-tier application to AWS. The web tier will be deployed on Amazon EC2 instances, while the data tier will utilize Amazon RDS for PostgreSQL. The company's security policy requires guest operating system patching and firewall port configurations to be strictly maintained. According to the AWS Shared Responsibility Model, which of the following statements correctly identifies the division of operational responsibilities between the customer and AWS for this deployment?

  1. A
    AWS is responsible for guest operating system patching on both the EC2 and RDS instances, while the customer is responsible for configuring security groups for the EC2 instances and network access control lists (NACLs) for the RDS instances.
  2. B
    The customer is responsible for guest operating system patching on both the EC2 and RDS instances, while AWS is responsible for configuring the security groups and firewall ports across all tiers of the VPC.
  3. The customer is responsible for guest operating system patching on the EC2 instances, while AWS is responsible for guest operating system patching on the RDS database instances; configuring security groups for both tiers remains the customer's responsibility.Answer
  4. D
    The customer is responsible for guest operating system patching on the EC2 instances, while AWS is responsible for both guest operating system patching and configuring the security groups on the RDS database instances.

Answer

The customer is responsible for guest operating system patching on the EC2 instances, while AWS is responsible for guest operating system patching on the RDS database instances; configuring security groups for both tiers remains the customer's responsibility.
Under the AWS Shared Responsibility Model, the division of labor depends on the type of service. For Infrastructure as a Service (IaaS) offerings like Amazon EC2, the customer is responsible for guest operating system patching. For managed database services like Amazon RDS, AWS is responsible for patching the guest operating system and the database engine. However, configuring network access controls (such as security groups and firewall ports) is a customer responsibility across both IaaS and managed database tiers to ensure secure access control.

Step-by-Step Solution

1
Analyze the service model for the web tier using Amazon EC2.
Identify EC2 as Infrastructure as a Service (IaaS).
Under the Shared Responsibility Model, IaaS gives the customer full control over the guest operating system, making them responsible for patching it.
2
Analyze the service model for the data tier using Amazon RDS.
Identify RDS as a managed database platform service (PaaS).
Because RDS is a managed service, AWS abstracts the operating system layer, meaning AWS is responsible for patching the guest operating system and database engine.
3
Evaluate the firewall configuration requirements (Security Groups).
Determine that security group configuration for both EC2 and RDS is a customer task.
Although AWS provides the security group infrastructure, configuring the inbound/outbound rules to protect applications and data represents security 'in' the cloud, which is always the customer's responsibility.
4
Synthesize the findings to identify the correct division of responsibilities.
The customer patches EC2, AWS patches RDS, and the customer configures security groups for both.
This correctly separates IaaS responsibilities from managed database platform responsibilities.

Key Concept

IaaS vs. Managed Database Shared Responsibility Boundaries
Rate this question

Topics

Shared Responsibility Model

More questions from this topic