CLF-C02 Question 71
Select 3You are migrating your company's on-premises web application to AWS. As part of the migration process, which of the following responsibilities will remain with your company, and which will AWS handle under the shared responsibility model?
- A
Managing the security of the physical infrastructure, such as data center access and hardware maintenance
- B
Configuring security groups and network access control lists (NACLs) for your application
- C
Ensuring that the data stored in your Amazon S3 buckets is encrypted at rest and in transit, based on your compliance requirements
- D
Patching the underlying operating system of an Amazon EC2 instance you launched
- E
Ensuring the availability of AWS services, such as Amazon S3 and Amazon EC2, within a specific AWS Region
Show answer and explanation
Correct answers: B, C, D
Explanation
The shared responsibility model divides responsibilities between AWS and the customer. AWS is responsible for the security 'of' the cloud, including the physical infrastructure and core services availability. Customers are responsible for security 'in' the cloud, which includes data protection, network configurations, and managing their operating systems for services like EC2. Understanding this division is critical when designing secure and compliant systems on AWS.
- A. Incorrect.
Managing the security of the physical infrastructure is the sole responsibility of AWS. AWS handles all aspects of the physical security of its data centers.
- B. Correct.
Configuring security groups and network access control lists (NACLs) is the customer's responsibility. These measures are part of application-level security that the customer controls.
- C. Correct.
Ensuring that your data is encrypted in Amazon S3 is the customer's responsibility. AWS provides the tools (like server-side encryption and HTTPS) but it's up to the customer to configure them based on their needs.
- D. Correct.
Patching the operating system of an Amazon EC2 instance is the customer's responsibility if they are managing the instance. AWS manages this only for fully managed services, such as AWS Lambda or Amazon RDS.
- E. Incorrect.
Ensuring the availability of AWS services, such as Amazon S3 and Amazon EC2, is AWS's responsibility. AWS guarantees service availability through its Service Level Agreements (SLAs).