AWS Shared Responsibility Model for Container Services
A cybercrime investigator is evaluating a data breach in a company's AWS infrastructure. The breached service was categorized as an AWS container service. What primary security aspects were likely managed by the company and not by AWS, which the investigator should first focus on?
Community Votes
67% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests the distinction between infrastructure management (AWS) and application/data security (Customer), with a common trap being confusion over network controls in managed environments.
This question tests the AWS shared responsibility model specifically for managed container services like RDS, EMR, and Elastic Beanstalk. It establishes that customers retain responsibility for data management and firewall configuration while AWS handles the underlying platform.
Candidates often select Network configuration (B) assuming full control, but in managed container services, AWS abstracts much of the network layer, leaving data and specific access rules as the primary customer duties.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
In the context of managed AWS container services such as Amazon RDS, EMR, or Elastic Beanstalk, the shared responsibility model dictates that AWS manages the physical infrastructure, the hypervisor, the operating system, and the application platform. The customer is responsible for configuring the database schema, managing the data itself, and setting up the firewall rules (such as security groups or VPC configurations) that grant access to these services. Therefore, Data management and firewall configuration are the primary aspects managed by the company.Why the Other Options Are Wrong
Physical infrastructure (A) is entirely managed by AWS and is never the customer's responsibility. While network configuration (B) is partially true regarding security groups, it is less comprehensive than data management in this specific context, and AWS manages the underlying network fabric. Application platform and OS security (D) are explicitly managed by AWS in managed service offerings, relieving the customer of patching and hardening the OS.Community Comment Notes
As Elb noted, "For container services such as Amazon RDS... AWS manages the application platform and OS... Customers here are responsible for data management and firewall configuration." This aligns with the official shared responsibility breakdown for PaaS-like container offerings. Some learners argued for network configuration, but in managed services, the 'firewall' (security group) is the boundary, while the network stack is abstracted.Exam Strategy
Always identify if the service is 'Managed' (PaaS/SaaS) or 'Infrastructure' (IaaS). For managed services, assume AWS handles the OS, Platform, and Physical layers; the customer focuses on Data, Identity, and Access Management.
Frequently Asked Questions
Does AWS manage security groups for RDS?
AWS provides the default security group, but the customer creates and configures the rules within it, making firewall configuration a customer responsibility.
Why is OS security not the customer's job here?
In managed services like RDS or Elastic Beanstalk, AWS patches and maintains the underlying OS, so the customer does not handle OS security.