CLF-C02 Question 55
Select 3A company is using Amazon S3 to store sensitive customer data. According to the AWS shared responsibility model, which of the following tasks is the company responsible for?
- A
Configuring bucket policies to control access to the data
- B
Ensuring that the physical security of AWS data centers is maintained
- C
Encrypting sensitive data before uploading it to Amazon S3
- D
Managing the underlying hardware that runs Amazon S3
- E
Regularly reviewing and rotating IAM user credentials for accessing Amazon S3
Show answer and explanation
Correct answers: A, C, E
Explanation
The AWS shared responsibility model divides security and compliance responsibilities between AWS and the customer. While AWS manages the infrastructure and physical security, customers are responsible for securing their data, managing access permissions, and implementing best practices such as encryption and credential management.
- A. Correct.
Correct. Configuring bucket policies to control access to the data is the customer's responsibility, as it falls under managing access permissions for the data they store in AWS services.
- B. Incorrect.
Incorrect. AWS is responsible for the physical security of its data centers as part of its responsibilities in the shared responsibility model.
- C. Correct.
Correct. Encrypting sensitive data before uploading it to Amazon S3 is the customer's responsibility, as data protection is a shared responsibility where customers manage their own encryption and security measures at the data level.
- D. Incorrect.
Incorrect. Managing the underlying hardware that runs Amazon S3 is AWS's responsibility, as this falls under their role in maintaining the infrastructure.
- E. Correct.
Correct. Regularly reviewing and rotating IAM user credentials for accessing Amazon S3 is the customer's responsibility, as they must manage their own identity and access management processes.