Examkin

Question

Difficulty: MediumShared Responsibility Model

A pharmaceutical research firm is deploying an application that uses Amazon DynamoDB to store proprietary drug discovery data. Under the AWS Shared Responsibility Model, which of the following tasks is the responsibility of the customer?

  1. Defining fine-grained access control policies using IAM to restrict access to the database tables.Answer
  2. B
    Applying software updates and security patches to the operating system hosting the database.
  3. C
    Configuring stateless Network Access Control Lists (NACLs) directly on the DynamoDB database instances.
  4. D
    Scheduling physical security audits of the AWS data centers where the DynamoDB data is stored to retrieve compliance reports.

Answer

Defining fine-grained access control policies using IAM to restrict access to the database tables.
For fully managed services like Amazon DynamoDB, the customer is responsible for configuring access permissions, such as writing IAM policies to define who can access the DynamoDB tables. This falls under security 'in' the cloud.

Step-by-Step Solution

1
Analyze the AWS service model for Amazon DynamoDB.
Amazon DynamoDB is a fully managed database service (NoSQL), meaning AWS handles the underlying infrastructure, operating system, and database software.
Understanding the service type (IaaS vs. PaaS vs. Managed) determines the boundary of the Shared Responsibility Model.
2
Differentiate between security 'of' the cloud and security 'in' the cloud for DynamoDB.
AWS is responsible for physical security, operating system patching, and hardware management. The customer is responsible for data classification, encryption settings, and client-side access control.
This distinction helps identify customer-managed tasks vs. AWS-managed tasks.
3
Evaluate the choices to find the customer's responsibility.
Defining access control policies via IAM is a customer task, while OS patching and physical security are AWS tasks. Directly configuring NACLs on managed database instances is a misunderstanding since DynamoDB does not expose instances to the customer.
To select the correct option representing the customer's operational boundary.

Key Concept

Under the AWS Shared Responsibility Model, for managed services like DynamoDB, AWS manages the physical infrastructure, operating system, and database software, while the customer is responsible for data protection, access configuration (IAM), and endpoint security.
Estimated Time:1m 0s
Rate this question

Topics

Shared Responsibility Model

More questions from this topic