Examkin

Question

Difficulty: MediumShared Responsibility Model

A financial company is preparing for an external audit of its application running on Amazon EC2 instances. The company needs to restrict network access to the servers and collect compliance reports showing that the underlying AWS physical infrastructure meets industry security standards. Under the AWS Shared Responsibility Model, which of the following tasks is the responsibility of the customer?

  1. Configuring the security group rules to restrict inbound network traffic to the EC2 instances.Answer
  2. B
    Managing and upgrading the hypervisor software that virtualizes the physical hosts of the EC2 instances.
  3. C
    Configuring stateful security groups at the subnet level to block specific IP addresses.
  4. D
    Submitting a request to AWS Support to conduct a physical security audit of the data centers housing the EC2 instances.

Answer

Configuring the security group rules to restrict inbound network traffic to the EC2 instances.
Under the AWS Shared Responsibility Model, the customer is responsible for configuring security groups (which operate as a firewall at the instance level) to control inbound and outbound traffic to their resources. This is classified as security 'in' the cloud.

Step-by-Step Solution

1
Analyze the customer's requirements in the scenario.
The customer needs to restrict network access to EC2 instances and obtain compliance reports for the physical infrastructure.
Understanding the required tasks is necessary to map them to the correct side of the Shared Responsibility Model.
2
Determine the boundary of responsibility for each task.
Configuring security groups is a customer responsibility (security in the cloud), while physical data center security and hypervisor maintenance are AWS responsibilities (security of the cloud). Compliance reports for the physical infrastructure are retrieved by the customer using AWS Artifact.
This identifies the specific action that falls under the customer's operational duties.

Key Concept

AWS Shared Responsibility Model boundaries for Infrastructure as a Service (IaaS) resources
Estimated Time:1m 30s
Rate this question

Topics

Shared Responsibility Model

More questions from this topic