Examkin

Question

Difficulty: HardShared Responsibility Model

A financial organization is using AWS Storage Gateway (Volume Gateway) deployed as a virtual machine (VM) on their on-premises VMware ESXi hypervisor to replicate local file data to Amazon S3. Under the AWS Shared Responsibility Model, which of the following operational security tasks is the responsibility of AWS?

  1. Providing and deploying software updates and security patches for the Storage Gateway virtual appliance guest operating system and application software.Answer
  2. B
    Securing the physical facilities, power, and host hypervisor environment where the Storage Gateway virtual machine is running.
  3. C
    Defining AWS Security Groups at the subnet level on-premises to block unauthorized local network access to the gateway.
  4. D
    Utilizing AWS Artifact to automatically audit and generate compliance certification reports for the on-premises virtual host.

Answer

Providing and deploying software updates and security patches for the Storage Gateway virtual appliance guest operating system and application software.
AWS is responsible for providing and deploying software updates and security patches for the Storage Gateway virtual appliance. Because it is a managed virtual appliance, AWS maintains and packages updates for the gateway software and its underlying operating system, though the customer retains control over the schedule for applying these updates.

Step-by-Step Solution

1
Analyze the service model and deployment type.
AWS Storage Gateway is a hybrid storage service. The virtual machine runs on-premises, but the gateway software itself is a managed appliance provided by AWS.
Understanding where the service components run is key to identifying the boundary of the Shared Responsibility Model.
2
Determine the boundary of responsibility for the gateway software appliance.
AWS is responsible for building, patching, and maintaining the VM appliance's guest operating system and gateway software.
AWS maintains operational control over the software image of the appliance, even though it runs on customer-owned hardware.
3
Evaluate the customer's on-premises responsibilities.
The customer is responsible for the physical security of the on-premises data center, the hypervisor configuration, local networking, and the protection of local data.
AWS cannot manage or secure physical hardware, hypervisors, or networks that are outside of its cloud infrastructure.

Key Concept

Shared Responsibility Model for Hybrid Services
Rate this question

Topics

Shared Responsibility Model

More questions from this topic