Examkin

Question

Difficulty: MediumShared Responsibility Model

A financial technology company deploys a transactional database using Amazon Relational Database Service (Amazon RDS). As part of a security audit, the company must document the division of operational tasks based on the AWS Shared Responsibility Model. Which of the following tasks is the customer's responsibility under the AWS Shared Responsibility Model for this database deployment?

  1. A
    Applying security patches and updates to the guest operating system hosting the database engine
  2. B
    Managing the physical security and environmental controls of the storage servers containing the database volumes
  3. Configuring database-level user access controls and network access rules via database security groupsAnswer
  4. D
    Generating third-party compliance certification reports, such as SOC 2, for the AWS data center physical infrastructure

Answer

Configuring database-level user access controls and network access rules via database security groups
Configuring network access rules using database security groups and managing database-level user access are customer responsibilities (security 'in' the cloud). Even under a managed database service like Amazon RDS, the customer must configure who can access the database resources.

Step-by-Step Solution

1
Identify the type of service being utilized in the scenario.
Amazon RDS is identified as a managed platform-as-a-service (PaaS) database offering.
The Shared Responsibility Model shifts the operational boundary depending on whether the service is classified as IaaS or PaaS/managed.
2
Determine the boundary of responsibility for a managed database service.
AWS manages physical hardware, infrastructure, and virtual machines (including guest OS patching). The customer maintains responsibility for the data, database engine configurations, access credentials, and network firewall configurations.
This establishes which operations are handled by AWS and which must be configured by the customer's administrative team.
3
Evaluate the choices to isolate the customer-managed task.
Managing database security groups and user access privileges is a customer task, whereas patching the OS, securing physical hardware, and auditing facilities are AWS responsibilities.
Applying the Shared Responsibility Model rules eliminates AWS-side responsibilities and isolates the correct customer action.

Key Concept

AWS Shared Responsibility Model for Managed Services
Rate this question

Topics

Shared Responsibility Model

More questions from this topic