Examkin

Question

Difficulty: MediumShared Responsibility Model

A mobile gaming startup is deploying a high-throughput, low-latency leaderboard and player session store using Amazon ElastiCache for Redis. The startup needs to secure this environment to protect user session tokens from unauthorized external access while maintaining compliance with regional data privacy standards. Under the AWS Shared Responsibility Model, which of the following tasks is the sole responsibility of the customer?

  1. Configuring VPC security groups to restrict network access to the cache cluster nodesAnswer
  2. B
    Applying security patches and updates to the guest operating system running the Redis engine
  3. C
    Configuring network Access Control Lists (NACLs) to statefully track and filter inbound connections at the cache node level
  4. D
    Conducting on-site physical audits of AWS data centers to verify physical security compliance for external auditors

Answer

Configuring VPC security groups to restrict network access to the cache cluster nodes
The correct answer is configuring VPC security groups to restrict network access to the cache cluster nodes. Under the AWS Shared Responsibility Model, firewall configuration and network access controls (such as security groups) are always the customer's responsibility, regardless of whether the service is IaaS or a managed database/cache service.

Step-by-Step Solution

1
Analyze the service type in the scenario.
Amazon ElastiCache for Redis is a managed database/caching service.
Managed services shift the management of the underlying physical infrastructure, operating system, and database software patching to AWS.
2
Determine the boundary of customer responsibility for managed services under the Shared Responsibility Model.
The customer remains responsible for data protection, identity and access management (IAM), and network traffic configuration (such as security groups).
This isolates the customer's responsibility to security 'in' the cloud, specifically network firewall rules and access credentials.
3
Evaluate the choices to find the one matching the customer's responsibility.
Configuring VPC security groups is a customer task, whereas patching the guest OS, maintaining physical security, and performing physical audits are AWS responsibilities.
This correctly identifies the boundary of network security configuration for ElastiCache nodes.

Key Concept

Shared Responsibility Model for Managed Services
Estimated Time:1m 5s
Rate this question

Topics

Shared Responsibility Model

More questions from this topic