A company is using Amazon DynamoDB to store user profile data for a mobile application. Under the AWS Shared Responsibility Model, which two of the following tasks are the responsibility of the customer? (Select TWO.)
- Configuring Identity and Access Management (IAM) policies to restrict table accessAnswer
- Enabling client-side encryption for the data before it is written to the tableAnswer
- CApplying security updates and OS patches to the underlying database servers
- DReplacing failing physical solid-state drives (SSDs) in the AWS data centers
- EUpgrading the DynamoDB database engine software version
Answer
Configuring Identity and Access Management (IAM) policies to restrict table access and Enabling client-side encryption for the data before it is written to the table
Configuring access control policies and managing data encryption (like client-side encryption) are customer responsibilities because they fall under 'security in the cloud'. The customer has sole control over who is authorized to access their database resources and how their data is encrypted before or during transit.
Step-by-Step Solution
Key Concept
Under the AWS Shared Responsibility Model, AWS is responsible for 'security of the cloud' (managed database engine, OS patching, hardware, and physical security), while the customer is responsible for 'security in the cloud' (data classification, client-side encryption, and access management/IAM policies).