Examkin

Question

Difficulty: HardShared Responsibility Model

A retail company is migrating its core transactional inventory system to Amazon Aurora MySQL-Compatible Edition. The database will store sensitive inventory and pricing data and must be accessible only by specific application servers running in a private subnet. According to the AWS Shared Responsibility Model, which TWO of the following tasks are the responsibility of the customer to secure and maintain this database cluster?

  1. Configuring database-level user accounts, database permissions, and roles within the MySQL database engine.Answer
  2. Setting up security group rules to restrict incoming database traffic to only the authorized application servers.Answer
  3. C
    Installing operating system security updates and patching the virtual machines hosting the database cluster.
  4. D
    Replacing failed physical hard drives and performing hardware maintenance in the data centers hosting the database.
  5. E
    Conducting physical inspections of AWS data centers to verify compliance with industry security standards.

Answer

Configuring database-level user accounts, permissions, and roles within the MySQL engine, as well as setting up security group rules to restrict network traffic, are the responsibilities of the customer.
For a managed database service like Amazon Aurora, the customer is responsible for 'security in the cloud'. This includes configuring database-level users, roles, and permissions within the engine to enforce the principle of least privilege, and configuring network security rules (security groups) to control which resources can communicate with the database. AWS handles the maintenance of the underlying physical servers, hypervisors, and guest operating system.

Step-by-Step Solution

1
Identify the type of service being used in the scenario.
Amazon Aurora is a fully managed relational database service.
Understanding the service category (managed database/PaaS) helps determine the boundary where AWS takes over guest OS and software maintenance.
2
Evaluate the customer's responsibilities for a managed database service.
The customer is responsible for firewall settings (security groups), data encryption configurations, and database-level user access control.
AWS manages the database platform, but the customer retains control over network access to the database and internal database-level permissions.
3
Identify AWS's responsibilities for a managed database service.
AWS handles physical infrastructure security, host operating system patching, database engine updates, and hardware lifecycle management.
Managed services offload the operational burden of OS-level administration and physical infrastructure management to AWS.
4
Select the two correct options that map to the customer's responsibilities.
The correct selections are managing database-level user accounts/roles and configuring security group rules.
These tasks directly represent configuration of access control and network firewalls, which remain customer responsibilities.

Key Concept

AWS Shared Responsibility Model for Managed Services (PaaS)
Rate this question

Topics

Shared Responsibility Model

More questions from this topic