A team migrates a self-managed database running on Amazon EC2 to Amazon RDS so that AWS manages more of the stack. Which TWO security responsibilities move from the customer to AWS as a result of using this managed service? (Select TWO.)
- APatching the underlying database engine software and the host operating system it runs on Correct
- BGranting and reviewing the IAM permissions that decide who may connect to the database
- CMaintaining the physical servers and the underlying infrastructure that the database runs on Correct
- DConfiguring which network sources are permitted to reach the database over the network
- EClassifying the stored data and deciding which records require encryption at rest
Why A is correct: With Amazon RDS, AWS handles patching of the database engine and the host operating system that the customer previously maintained themselves.
Why B is wrong: This seems handed over, but managing identity and access permissions remains a customer responsibility on any AWS service, including Amazon RDS.
Why C is correct: Maintaining the host hardware and supporting infrastructure is security of the cloud, which AWS performs for the managed Amazon RDS service.
Why D is wrong: Network access controls such as security groups stay with the customer, who still decides which sources may reach the database.
Why E is wrong: Data classification and the decision to encrypt remain customer duties, because only the customer understands the sensitivity of its own data.