Examkin

Question

Difficulty: HardShared Responsibility Model

A media company is migrating its user authentication store to Amazon DynamoDB. The company must comply with strict industry data security standards. Under the AWS Shared Responsibility Model, which two security tasks are the responsibility of the customer? (Select TWO.)

  1. Configuring AWS Identity and Access Management (IAM) policies to restrict database access to authorized application serversAnswer
  2. Encrypting sensitive user password hashes on the client side before writing them to the tableAnswer
  3. C
    Applying security patches to the guest operating system hosting the database engine
  4. D
    Attaching security groups to the DynamoDB tables to restrict network access to the database endpoints
  5. E
    Replacing failing solid-state drives (SSDs) in the underlying physical storage servers

Answer

The customer is responsible for configuring AWS Identity and Access Management (IAM) policies to restrict database access and encrypting sensitive user password hashes on the client side.
For fully managed services such as Amazon DynamoDB, AWS manages the physical infrastructure, the virtualization layer, the operating system, and the database software itself. The customer is responsible for managing data inside the service, which includes configuring IAM policies to restrict API access and implementing data encryption (such as client-side encryption before writing data to AWS).

Step-by-Step Solution

1
Analyze the service model of the AWS resource in the scenario.
Amazon DynamoDB is a fully managed NoSQL database service (Platform as a Service / Database as a Service).
The level of customer responsibility depends on whether the service is Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or a managed service.
2
Differentiate between customer responsibilities and AWS responsibilities for fully managed database services.
AWS handles physical security, infrastructure, hardware maintenance, OS patching, and database software updates. The customer handles data classification, IAM access controls, client-side encryption, and service configurations.
This determines which tasks belong to the customer ('security in the cloud') versus AWS ('security of the cloud').
3
Evaluate the choices to select the two customer responsibilities.
IAM policy configuration and client-side encryption are customer responsibilities, whereas OS patching, hardware disk replacement, and table-level security groups (which do not exist for DynamoDB) are not.
To correctly identify the final options that match the customer's domain of control under the model.

Key Concept

Under the AWS Shared Responsibility Model, for managed services like Amazon DynamoDB, AWS operates the infrastructure layer, the operating system, and the database platform. The customer retains responsibility for securing their data, including access control (IAM) and data encryption.
Rate this question

Topics

Shared Responsibility Model

More questions from this topic