Examkin

Question

Difficulty: Very hardShared Responsibility Model

A healthcare technology company is deploying a serverless application that processes patient health records. The architecture consists of an HTTPS endpoint hosted on Amazon API Gateway, custom backend logic running in AWS Lambda, and patient data stored in Amazon DynamoDB. Under the AWS Shared Responsibility Model, which two security and operational tasks are the responsibility of the customer? (Select TWO.)

  1. Configuring IAM execution roles and resource-based policies to restrict access between the Lambda functions and DynamoDB tablesAnswer
  2. B
    Applying security patches and version updates to the guest operating systems and language runtimes executing the Lambda functions
  3. Defining authorization mechanisms in API Gateway and securing the custom application code deployed in LambdaAnswer
  4. D
    Managing the physical security, climate controls, and hardware life cycle of the physical disks where DynamoDB data is replicated
  5. E
    Securing the hypervisor layer and container virtualization hosts that isolate concurrent Lambda function executions

Answer

Configuring IAM execution roles and resource-based policies to restrict access between the Lambda functions and DynamoDB tables, and defining authorization mechanisms in API Gateway and securing the custom application code deployed in Lambda.
For serverless services like AWS Lambda, Amazon DynamoDB, and Amazon API Gateway, AWS assumes responsibility for the entire infrastructure stack, including physical hardware, OS patching, runtime environments, and virtualization. The customer remains responsible for data classification, configuring Identity and Access Management (IAM) execution roles and access policies, API Gateway authorization configurations, and securing the custom application code deployed to the environment.

Step-by-Step Solution

1
Analyze the service models of the resources in the scenario.
Amazon API Gateway, AWS Lambda, and Amazon DynamoDB are fully managed, serverless (Platform as a Service) resources.
Under the Shared Responsibility Model, the boundary between customer and AWS duties shifts depending on the service category.
2
Identify AWS responsibilities for serverless resources.
AWS is responsible for physical security, hardware management, hypervisor security, operating system patching, and runtime updates.
These lower-level infrastructure tasks are fully managed and abstracted away from the customer in serverless offerings.
3
Identify customer responsibilities for serverless resources.
The customer is responsible for configurations, identity and access control (IAM), client-side encryption, API Gateway authentication, and writing secure application code.
Even in a fully managed model, the customer must control access to their data and secure the application logic.
4
Match the options to the correct responsibility boundaries.
Configuring IAM roles and setting up API authorization/securing application code are customer duties, whereas patching container runtimes, physical disk security, and hypervisor management are AWS duties.
This separates customer actions (security in the cloud) from AWS actions (security of the cloud).

Key Concept

Shared Responsibility Model for Serverless Services
Rate this question

Topics

Shared Responsibility Model

More questions from this topic