Examkin

Question

Difficulty: HardShared Responsibility Model

A multinational retail company is hosting its web applications on Amazon EC2 instances and is preparing for an upcoming external security audit. The company needs to document the exact division of security tasks between themselves and AWS. Which of the following tasks is the sole responsibility of AWS under the AWS Shared Responsibility Model?

  1. Patching and maintaining the hypervisor software that virtualizes the physical hosts running the instancesAnswer
  2. B
    Installing security patches and operating system updates on the guest operating system of the EC2 instances
  3. C
    Configuring stateless Network Access Control Lists (NACLs) to secure subnet-level traffic
  4. D
    Retrieving third-party compliance reports and certifications from the AWS Artifact portal to present to the auditors

Answer

Patching and maintaining the hypervisor software that virtualizes the physical hosts running the instances
Under the AWS Shared Responsibility Model, AWS is responsible for 'Security of the Cloud,' which encompasses the physical infrastructure, global network, hardware, and virtualization hypervisor. For Amazon EC2, which is an Infrastructure as a Service (IaaS) service, the hypervisor layer is managed exclusively by AWS, making the patching of this layer the sole responsibility of AWS.

Step-by-Step Solution

1
Identify the service type in the scenario
The scenario specifies Amazon EC2, which is an Infrastructure as a Service (IaaS) offering.
The division of responsibilities under the AWS Shared Responsibility Model depends heavily on whether the service is IaaS, PaaS, or SaaS.
2
Determine the boundary between AWS and customer responsibilities for IaaS
For EC2, AWS manages the physical security, hardware, and the virtualization layer (hypervisor). The customer manages everything from the guest operating system upward, including network traffic configurations and IAM permissions.
This helps isolate which options belong to AWS (security of the cloud) and which belong to the customer (security in the cloud).
3
Evaluate the options against this boundary
Hypervisor maintenance is an infrastructure/virtualization layer task managed by AWS. Guest OS patching, NACL configuration, and compliance document retrieval from the portal are active tasks performed by the customer.
To select the correct option representing the sole responsibility of AWS.

Key Concept

Shared Responsibility Model IaaS boundaries
Estimated Time:2m 0s
Rate this question

Topics

Shared Responsibility Model

More questions from this topic