Examkin

Question

Difficulty: MediumShared Responsibility Model

A gaming studio is deploying a multiplayer matchmaking backend on AWS using Amazon DynamoDB to store player session states. Under the AWS Shared Responsibility Model, which two security-related tasks are the sole responsibility of the gaming studio?

  1. Implementing client-side encryption for sensitive player data before sending it to the databaseAnswer
  2. Configuring Identity and Access Management (IAM) policies to restrict access to the database tablesAnswer
  3. C
    Applying security patches to the underlying operating system hosting the database nodes
  4. D
    Updating the database engine software to resolve system-level software vulnerabilities
  5. E
    Scheduling physical inspections of the AWS data centers to perform hardware security audits

Answer

Implementing client-side encryption for sensitive player data before sending it to the database and configuring Identity and Access Management (IAM) policies to restrict access to the database tables are customer responsibilities.
In the Shared Responsibility Model, the customer is responsible for security 'in' the cloud. For a managed service like Amazon DynamoDB, this includes managing user access via Identity and Access Management (IAM) policies and encrypting sensitive player data on the client side before writing it to the database. AWS maintains the security 'of' the cloud, which includes the physical hardware, operating systems, and database engine software.

Step-by-Step Solution

1
Analyze the service type in the scenario.
Amazon DynamoDB is identified as a fully managed database service (NoSQL).
Managed services shift operational tasks (like patching and physical security) to AWS, meaning the customer is responsible primarily for data configuration and access control.
2
Evaluate the customer's responsibilities for a managed database service.
The customer controls identity and access management (IAM) and how they secure the data itself (client-side encryption).
In the Shared Responsibility Model, data security 'in the cloud' (including encryption and access control) remains the customer's responsibility, regardless of the service type.
3
Identify AWS's responsibilities for DynamoDB.
AWS is responsible for managing the physical data centers, host operating systems, and the DynamoDB database engine software.
AWS manages the infrastructure layer, hardware, and system software for managed services, making guest OS patching, database software updates, and physical audits part of the AWS responsibility ('of the cloud').

Key Concept

Shared Responsibility Model for Managed Services
Rate this question

Topics

Shared Responsibility Model

More questions from this topic