Examkin

Question

Difficulty: MediumShared Responsibility Model

An online education platform is deploying a new serverless application using AWS Lambda functions. Under the AWS Shared Responsibility Model, which of the following tasks is the responsibility of the customer?

  1. A
    Updating the host operating system and patching runtime environments for the Lambda function.
  2. B
    Requesting AWS Support to prepare and email the SOC 2 compliance reports for the physical hosting infrastructure.
  3. Configuring the Identity and Access Management (IAM) execution role and access policies for the Lambda function.Answer
  4. D
    Managing the physical security and decommissioning of the storage media hosting the serverless code.

Answer

Configuring the Identity and Access Management (IAM) execution role and access policies for the Lambda function.
Configuring the IAM execution role and access policies is a customer responsibility under security 'in' the cloud. The customer must define permissions to ensure the function only accesses the resources it requires (least privilege rule).

Step-by-Step Solution

1
Analyze the service classification specified in the scenario.
The application runs on AWS Lambda, which is classified as a serverless/managed service.
Different service categories (IaaS vs. PaaS/Serverless) shift the boundaries of the Shared Responsibility Model, with AWS taking on more administrative responsibilities for managed services.
2
Determine the boundary between AWS and customer responsibilities for managed serverless resources.
AWS manages physical security, virtualization, container OS, and execution runtimes. The customer manages application code, data classification, and Identity and Access Management (IAM) permissions.
This division isolates infrastructure maintenance from application-level configurations and security settings.
3
Evaluate the choices to locate the one that describes a customer configuration task.
Configuring IAM execution roles is an access management task performed by the customer inside the console or API.
IAM settings are always managed by the customer to maintain control over authorization and resource access.

Key Concept

Shared Responsibility Model for Serverless Services
Estimated Time:1m 30s
Rate this question

Topics

Shared Responsibility Model

More questions from this topic