Examkin

Question

Difficulty: EasyData Protection and Encryption

A startup is setting up an application on AWS and must encrypt its customer data at rest. According to the AWS Shared Responsibility Model, which of the following is the customer's responsibility regarding data protection?

  1. Enabling and configuring encryption for the application's storage volumesAnswer
  2. B
    Physically securing the hardware security modules (HSMs) used for key generation
  3. C
    Managing the hardware lifecycle and decommissioning old storage drives
  4. D
    Provisioning a dedicated, single-tenant AWS CloudHSM cluster to enable standard S3 bucket encryption

Answer

Enabling and configuring encryption for the application's storage volumes
The correct answer is correct because configuring and enabling encryption for customer-controlled assets (such as storage volumes and database instances) is a customer responsibility ('Security in the Cloud') under the AWS Shared Responsibility Model.

Step-by-Step Solution

1
Identify the boundary between customer and AWS responsibilities under the Shared Responsibility Model.
AWS is responsible for 'Security of the Cloud' (physical infrastructure, hardware, virtualization layer), while the customer is responsible for 'Security in the Cloud' (customer data, platform, applications, identity and access management).
This establishes which operations fall under AWS control versus customer control.
2
Evaluate the choices to determine which action is performed by the customer.
Enabling and configuring encryption on storage volumes is a configuration task performed by the customer on their own resources ('Security in the Cloud'). Tasks like physical security of hardware and drive decommissioning are 'Security of the Cloud' managed by AWS.
This identifies the correct customer responsibility.

Key Concept

Under the AWS Shared Responsibility Model, customers are responsible for data protection configuration (Security in the Cloud), such as enabling encryption on storage volumes, while AWS manages the physical security and infrastructure (Security of the Cloud).
Rate this question

Topics

Data Protection and Encryption

More questions from this topic