Mixed practice exam 3

Explanation

Answer: D. AWS divides the model into security OF the cloud, which AWS performs, and security IN the cloud, which the customer performs. Everything the customer can configure through the AWS APIs and console sits on the customer side, and deciding which identities may act on a resource is one of the clearest examples.

• A. The network fabric connecting Availability Zones is AWS-owned global infrastructure and is entirely AWS's responsibility.
• B. The hypervisor and the host firmware beneath it are part of the virtualization layer AWS maintains. Customers have no access to that layer.
• C. Hardware maintenance inside AWS facilities is part of the infrastructure AWS operates. Customers never see or touch the physical devices.

Explanation

Answer: A and B. Both sit in the layer AWS calls security OF the cloud: the hardware, software, networking, and facilities that run AWS Cloud services. The customer can neither see nor configure the service software behind a managed service, nor enter an AWS data center, so neither task can be delegated back to them.

• C. Credentials belonging to the customer's application are customer content. AWS offers services that help manage and rotate them but does not own them.
• D. Amazon S3 now encrypts every new object with SSE-S3 automatically, but the customer still chooses which encryption method protects its content and, for SSE-KMS, which key and key policy govern it. Those choices, and the data they protect, remain customer responsibilities.
• E. Network architecture inside a VPC is built entirely by the customer using AWS-provided constructs, and is a core security IN the cloud task.

Explanation

Answer: A. Amazon S3 is an abstracted service: AWS operates the infrastructure, the operating system, and the platform, and the customer interacts only with endpoints. What remains with the customer is the content itself, its classification, its encryption choices, and the permissions that decide who may reach it.

• B. Storage hardware is AWS infrastructure. Its maintenance, replacement, and eventual secure destruction are AWS responsibilities.
• C. The software implementing the service is operated by AWS. Customers have no ability to patch it and no visibility into it.
• D. Durability is an attribute of the service that AWS engineers and operates, achieved by redundancy that AWS manages internally.

Explanation

Answer: D. Fargate is a serverless compute engine, so AWS provisions, patches, and maintains the underlying compute capacity and its operating system. The customer never chooses an instance type or logs into a host, which is exactly the operational surface that moves to AWS.

• A. Network access controls for a task are configured by the customer. AWS provides the security group construct; the rules inside it are a customer decision.
• B. Permissions granted to a task are defined by the customer in an IAM role. Fargate changes where the container runs, not who decides what it may do.
• C. The container image, its base layers, and its dependencies are software the customer supplies. Their security remains the customer's responsibility on any compute platform.

Explanation

Answer: A. A shared control is one where both parties carry out the same class of activity in completely separate contexts. For awareness and training, each organization is accountable for its own workforce: AWS trains AWS employees, and the customer trains the people who build and operate the customer's workloads.

• B. AWS publishes training and certification offerings commercially, but delivering a customer's internal security awareness program is not part of the shared responsibility model.
• C. Certifications attest that AWS operates its controls effectively. They say nothing about whether the customer's own staff are trained, which auditors will still expect the customer to demonstrate.
• D. Responsibility never runs in that direction. AWS personnel are governed by AWS internal controls, which the customer evidences through AWS audit reports rather than by training AWS staff.

Explanation

Answer: C. DynamoDB is an abstracted service, so AWS runs everything from the hardware up to the platform. The customer's remaining duties concentrate on the content: knowing what the data is, deciding how sensitive it is, and controlling which principals can read or write it.

• A. There is no operating system exposed to the customer in DynamoDB. AWS operates the entire fleet behind the service endpoint.
• B. Redundancy across Availability Zones is built into the service by AWS. The customer does not configure or maintain it.
• D. The service software is AWS's to maintain. Customers cannot install or defer updates to it.

Explanation

Answer: D. Customer specific controls have no AWS counterpart at all. AWS names service and communications protection, and zone security, as controls that depend entirely on how the customer designs and segments its own application, so AWS performs no equivalent activity.

• A. Patch management is one of the three shared controls, carried out by both parties in different scopes.
• B. Physical and environmental controls are inherited controls. The customer fully inherits them from AWS and performs no part of them.
• C. Awareness and training is also a shared control, since both AWS and the customer must train their own people.

Explanation

Answer: C. Ownership of content never transfers to AWS. The customer chooses which services hold the data, which AWS Regions store it, how it is classified and encrypted, and who may access it. Retention and classification are decisions only the data owner can make.

• A. Moving to an abstracted service reduces the customer's operational work but does not transfer ownership of the data or the decisions about it.
• B. The shared controls AWS names are patch management, configuration management, and awareness and training. Data classification is not among them.
• D. Operating the storage platform is not the same as owning what is stored on it. AWS provides the service; the content and the decisions about it stay with the customer.

Explanation

Answer: C. AWS states directly that customer responsibility is determined by the AWS Cloud services the customer selects. A workload on Amazon EC2 leaves the customer managing a guest operating system, while the same workload built on an abstracted service leaves the customer managing little beyond data and access.

• A. Customers retain ownership and control of their content in every AWS service. AWS operates the service, not the data inside it.
• B. A fixed split would contradict the whole design of the model, which is explicitly service dependent.
• D. Physical and environmental security is an inherited control that the customer receives wholly from AWS.

Explanation

Answer: B. AWS curates and publishes security updates for supported managed runtimes, and by default applies them automatically. Choosing Manual mode pins the function to one runtime version, which is useful for rolling back an incompatible change, but it moves the timing decision, and therefore the exposure window, to the customer.

• A. AWS continues to publish runtime updates regardless of any one customer's update mode. Manual mode only changes whether that function picks them up.
• C. Every workload on AWS sits inside the model. The boundary can shift with the service and its configuration, but nothing falls outside it.
• D. The execution environment's operating system is AWS's responsibility in every Lambda update mode. The customer has no host to patch.