CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS is responsible for physical security of data centers

  Why it's wrong here

  AWS operates under a shared responsibility model where it is indeed responsible for the "security of the cloud," which includes the physical security of its data centers, hardware, and global infrastructure. However, an S3 bucket misconfiguration, such as an overly permissive policy, falls under the customer's "security in the cloud" responsibilities. Therefore, while the statement about AWS's physical security is true, it does not address the root cause of an exposed S3 bucket.

• ✗

  The customer is responsible for patching the S3 service

  Why it's wrong here

  Under the AWS shared responsibility model, AWS is fully responsible for the operational aspects and underlying infrastructure of managed services like S3, which includes patching the S3 service itself. Customers are not granted access to the underlying S3 service infrastructure to perform patching or maintenance. The customer's responsibility lies in configuring the service correctly, specifically managing access policies and permissions for their S3 buckets and objects.

• ✓

  The customer is responsible for configuring access controls and permissions

  Why this is correct

  This statement is correct because, within the AWS shared responsibility model, the customer is solely responsible for the "security in the cloud." For S3, this explicitly includes defining and implementing appropriate access controls and permissions. This involves configuring S3 bucket policies, Access Control Lists (ACLs), and AWS Identity and Access Management (IAM) policies to restrict who can access, modify, or delete data within their S3 buckets. A misconfiguration in these controls directly leads to data exposure.

• ✗

  AWS is responsible for network infrastructure; the customer for data classification

  Why it's wrong here

  While AWS is indeed responsible for the underlying network infrastructure that supports S3, ensuring its availability and security, this is part of the "security of the cloud." The customer is responsible for data classification, determining the sensitivity of data stored in S3. However, the specific issue of an exposed S3 bucket stems from misconfigured access controls, which is a customer responsibility for "security in the cloud," not directly related to the underlying network or merely classifying the data.

Go deeper

Related to this question