Examkin

Question

Difficulty: MediumShared Responsibility Model

A logistics company runs its tracking application using containerized microservices on Amazon Elastic Container Service (Amazon ECS) with the AWS Fargate launch type. To maintain a robust security posture, the company needs to define the boundaries of the AWS Shared Responsibility Model for this serverless container environment.

Which of the following security tasks are the responsibility of the customer? (Select TWO.)

  1. Patching the software and dependencies running inside the application container imagesAnswer
  2. Configuring security groups to control inbound and outbound network traffic to the ECS tasksAnswer
  3. C
    Patching the underlying container host operating system and virtualization software
  4. D
    Configuring stateless Network Access Control Lists (NACLs) at the task level to filter traffic to individual containers
  5. E
    Managing physical compliance audits and certifications for the AWS data center facilities

Answer

The customer is responsible for patching software and dependencies inside the application container images and configuring security groups to control inbound and outbound network traffic to the ECS tasks.
Under the AWS Shared Responsibility Model, serverless services like AWS Fargate shift host management responsibilities to AWS. The customer remains responsible for securing container contents (such as application code and package dependencies) and defining task-level firewall rules (such as security groups).

Step-by-Step Solution

1
Identify the AWS service type and launch model used in the scenario.
The application runs on Amazon ECS with the AWS Fargate launch type, which is a serverless compute engine for containers.
This determines that the virtualization layer and underlying host operating system are fully managed by AWS.
2
Differentiate between customer responsibilities (security in the cloud) and AWS responsibilities (security of the cloud) for serverless container workloads.
The customer manages application code, data, container images, and network access rules (security groups). AWS manages physical facilities, host hardware, the host OS, and the hypervisor.
Correctly allocating tasks prevents security gaps and mapping errors on the exam.

Key Concept

Shared Responsibility Model for Serverless Container Services
Rate this question

Topics

Shared Responsibility Model

More questions from this topic