Examkin

Question

Difficulty: Very hardShared Responsibility Model

A logistics company is containerizing its route-optimization API and deploying it using Amazon Elastic Container Service (Amazon ECS) with the AWS Fargate launch type. The security team is establishing operational workflows to comply with the AWS Shared Responsibility Model. Which of the following tasks remains the sole responsibility of the customer in this deployment model?

  1. A
    Configuring stateless Network Access Control Lists (NACLs) directly at the individual ECS task level to define container-to-container boundary controls.
  2. Updating and patching the application libraries, dependencies, and base operating system files packaged inside the container image.Answer
  3. C
    Applying security updates and operating system patches to the underlying physical hosts and hypervisors that run the container tasks.
  4. D
    Submitting physical data center access requests directly to AWS compliance auditors to verify SOC 2 Type II compliance reports.

Answer

Updating and patching the application libraries, dependencies, and base operating system files packaged inside the container image.
Under the AWS Shared Responsibility Model for AWS Fargate, AWS manages the physical security, hardware, virtualization hypervisor, and the host operating system. The customer remains fully responsible for everything inside the container, including application code, configuration settings, and patching the packages, libraries, and base operating system files included inside the container image itself.

Step-by-Step Solution

1
Analyze the service type used in the scenario.
Amazon ECS with AWS Fargate launch type is a container execution environment that abstracts host provisioning and management (a managed/serverless model).
Determining the service type defines the boundary of customer responsibility.
2
Identify the boundary of control for AWS Fargate.
AWS manages the host operating system, hypervisor, and physical infrastructure. The customer retains control of the container definition, IAM policies, and container contents.
Differentiates 'security of the cloud' (AWS) from 'security in the cloud' (customer).
3
Evaluate each option against the customer/AWS boundary.
The container image contents (libraries, OS files in the image) are packaged by the customer, making image patching a customer task. Host OS patching and physical security are AWS tasks. NACLs cannot be applied at the task level.
Pinpoints the correct operational task that belongs to the customer.

Key Concept

Under the Shared Responsibility Model for AWS Fargate, the customer is responsible for security 'in' the container (such as patching the container image layers and configuration), while AWS is responsible for security 'of' the container host, virtualization, and physical infrastructure.
Estimated Time:2m 0s
Rate this question

Topics

Shared Responsibility Model

More questions from this topic