Examkin

Question

Difficulty: MediumShared Responsibility Model

A media company is migrating its backend processing workloads to serverless architectures using AWS Lambda. The company wants to ensure that all aspects of this environment conform to their security policies. Under the AWS Shared Responsibility Model, which responsibility falls solely on the customer when deploying these serverless functions?

  1. A
    Applying security patches to the guest operating system and the hypervisor layer that runs the execution environment
  2. B
    Updating and maintaining the programming language runtimes, such as Python or Node.js, to fix security vulnerabilities
  3. Configuring the Identity and Access Management (IAM) execution roles that define which AWS resources the functions can accessAnswer
  4. D
    Establishing stateless Network Access Control Lists (NACLs) at the subnet level to restrict inbound traffic to the serverless container hosts

Answer

Configuring the Identity and Access Management (IAM) execution roles that define which AWS resources the functions can access
Under the AWS Shared Responsibility Model, AWS Lambda represents a serverless service where AWS manages the entire infrastructure stack, including physical security, hardware, virtualization, the guest operating system, and the application runtime. The customer's responsibility is focused on the security of their code and access management. This includes creating and configuring the Identity and Access Management (IAM) execution roles that specify the exact permissions the function has when interacting with other AWS services.

Step-by-Step Solution

1
Identify the AWS service type and its deployment model
AWS Lambda is a serverless (managed) compute service.
Managed services shift more infrastructure-level responsibilities (such as OS patching and runtime maintenance) to AWS.
2
Define the boundaries of the Shared Responsibility Model for serverless compute
AWS is responsible for physical security, hardware, virtualization, operating systems, and runtimes. The customer is responsible for application code, data, and access configurations.
This establishes which operational tasks belong to the customer.
3
Evaluate the operational tasks in the options against the boundary
Configuring the IAM execution role is a customer access management configuration, while patching the guest OS, maintaining language runtimes, and managing subnet hosts are AWS responsibilities.
This identifies the correct customer responsibility.

Key Concept

Shared Responsibility Model for Serverless Services
Estimated Time:1m 15s
Rate this question

Topics

Shared Responsibility Model

More questions from this topic