Examkin

Question

Difficulty: MediumShared Responsibility Model

A tourism agency is deploying a customer-facing mobile booking application and decides to use Amazon Cognito for user authentication and directory management. Under the AWS Shared Responsibility Model, which of the following is a responsibility of the customer?

  1. A
    Applying security updates and OS patches to the physical servers hosting the Cognito authentication endpoints
  2. B
    Configuring Network Access Control Lists (NACLs) at the subnet level to restrict network traffic directly to the Cognito user pool
  3. Configuring password complexity policies and enabling Multi-Factor Authentication (MFA) for the Cognito user poolsAnswer
  4. D
    Submitting a technical support ticket to request the latest ISO and PCI DSS compliance reports for AWS infrastructure

Answer

Configuring password complexity policies and enabling Multi-Factor Authentication (MFA) for the Cognito user pools
Under the AWS Shared Responsibility Model, configuring identity settings (such as password policies and MFA requirements) represents security 'in' the cloud, which is the customer's responsibility.

Step-by-Step Solution

1
Determine the type of AWS service described in the scenario.
Amazon Cognito is classified as a fully managed service.
Knowing that Amazon Cognito is a managed service helps establish that AWS manages the infrastructure, server patching, and physical security.
2
Identify which security tasks are customer-controlled configurations for the identity provider.
Defining user password complexity and enabling Multi-Factor Authentication (MFA) are configuration settings within the Cognito user pool.
Under the Shared Responsibility Model, the customer is responsible for access policies, identity settings, and data protection inside the managed service.

Key Concept

Under the AWS Shared Responsibility Model, for managed services like Amazon Cognito, AWS is responsible for physical security and server/infrastructure maintenance, while the customer is responsible for service configuration, data classification, and access policies.
Estimated Time:1m 0s
Rate this question

Topics

Shared Responsibility Model

More questions from this topic