2.1
Question 1
A company runs a web application on Amazon EC2. The company is responsible for applying security patches to the operating system installed on each EC2 instance. Which statement best explains this responsibility?
A. AWS is responsible because EC2 is an AWS-managed service.
B. The customer is responsible because the customer controls the guest operating system.
C. AWS and the customer are both responsible for applying patches to the same operating system.
D. Amazon RDS is responsible for applying patches to all operating systems in the AWS account.
Click to view Answer & Explanation
**Correct Answer:** B **Explanation:** * **Why B is correct:** Under the shared responsibility model, the customer is responsible for managing and patching the guest operating system on EC2 instances. AWS manages the underlying physical infrastructure and hypervisor. * **Why distractors are incorrect:** * **A:** Although AWS operates the EC2 service, customers manage the guest operating system running inside their instances. * **C:** AWS manages the host infrastructure, but the customer manages the guest operating system. They do not both patch the same operating system. * **D:** Amazon RDS is a database service and is not responsible for operating system patches on EC2 instances.Question 2
A development team deploys application code to AWS Lambda. The team wants to understand which operating system maintenance tasks it must perform. Which responsibility belongs to AWS?
A. Patching the underlying operating system and managing the Lambda execution infrastructure
B. Reviewing the application code for security vulnerabilities
C. Managing the permissions assigned to the Lambda execution role
D. Encrypting sensitive values included in the application code
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** AWS manages the infrastructure, host operating systems, and execution environment used to run Lambda functions. This is one way customer responsibilities shift when using a managed service. * **Why distractors are incorrect:** * **B:** The customer is responsible for developing and reviewing its application code. * **C:** The customer manages IAM permissions and the Lambda execution role used by the function. * **D:** The customer is responsible for protecting sensitive application data and configuring appropriate encryption controls.Question 3
A company migrates its relational database from an EC2 instance to Amazon RDS for MySQL. Which responsibility shifts from the customer to AWS after the migration?
A. Designing database access permissions for application users
B. Managing the database schema and stored data
C. Managing the underlying operating system and database infrastructure
D. Choosing which users can connect to the database
Click to view Answer & Explanation
**Correct Answer:** C **Explanation:** * **Why C is correct:** With Amazon RDS, AWS manages the underlying infrastructure, operating system, and much of the database service administration. This is different from running a database directly on EC2. * **Why distractors are incorrect:** * **A:** The customer remains responsible for database access permissions and user authorization. * **B:** The customer manages the database schema, records, and application data. * **D:** The customer controls database users and connection access, including appropriate network and IAM configurations where applicable.Question 4
A company runs a custom application on Amazon EC2. The security team is reviewing tasks that remain the customer’s responsibility. Which TWO tasks are customer responsibilities? (Select TWO)
A. Replacing failed physical disks in AWS data centers
B. Applying security patches to the EC2 guest operating system
C. Configuring security groups for the EC2 instances
D. Maintaining the physical host servers
Click to view Answer & Explanation
**Correct Answers:** B and C **Explanation:** * **Why B is correct:** The customer manages the guest operating system installed on an EC2 instance, including operating system updates and security patches. * **Why C is correct:** The customer configures security groups and other network access controls for its EC2 resources. * **Why distractors are incorrect:** * **A:** AWS is responsible for maintaining and replacing physical data center equipment. * **D:** AWS manages the physical host servers and the infrastructure that supports EC2.Question 5
An auditor asks a company to identify responsibilities that always belong to AWS under the shared responsibility model. Which TWO responsibilities are AWS responsibilities? (Select TWO)
A. Protecting the physical security of AWS data centers
B. Configuring the customer’s IAM users and policies
C. Managing the hardware and facilities that run AWS services
D. Classifying and labeling the customer’s business data
Click to view Answer & Explanation
**Correct Answers:** A and C **Explanation:** * **Why A is correct:** AWS is responsible for the physical security of its data centers and facilities. * **Why C is correct:** AWS manages the underlying hardware, networking, storage, and facilities used to provide AWS services. * **Why distractors are incorrect:** * **B:** Customers are responsible for managing their IAM users, roles, groups, and policies. * **D:** Customers are responsible for classifying, handling, and protecting their own data according to business and regulatory requirements.Question 6
A company uses Amazon EC2 and wants to document controls that are shared between AWS and the customer. Which TWO controls are examples of shared responsibilities? (Select TWO)
A. Patch management
B. Physical security of AWS data centers
C. Configuration management
D. Replacement of AWS data center hardware
Click to view Answer & Explanation
**Correct Answers:** A and C **Explanation:** * **Why A is correct:** Patch management is shared. AWS patches and maintains the infrastructure it operates, while the customer patches the guest operating system and applications on EC2. * **Why C is correct:** Configuration management is shared. AWS manages the configuration of its infrastructure, while the customer configures resources such as EC2 instances, security groups, and IAM policies. * **Why distractors are incorrect:** * **B:** Physical security of AWS facilities is an AWS responsibility. * **D:** AWS is responsible for maintaining and replacing its physical infrastructure.Question 7
A company stores confidential information in an application running on Amazon EC2. The company wants to ensure that only authorized users can access the information. Which action is primarily the customer’s responsibility?
A. Restricting access through IAM policies and application permissions
B. Securing the physical buildings where the EC2 servers are located
C. Maintaining the AWS hypervisor
D. Replacing failed storage hardware in the AWS data center
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** The customer is responsible for controlling access to its data and resources by configuring IAM policies, application permissions, and other appropriate security controls. * **Why distractors are incorrect:** * **B:** AWS is responsible for the physical security of its data centers. * **C:** AWS manages the hypervisor and underlying virtualization infrastructure. * **D:** AWS manages and replaces physical hardware used in its data centers.Question 8
A company runs a database on an EC2 instance and later migrates it to Amazon RDS. Which change in responsibility should the company expect?
A. AWS manages more of the database infrastructure after the migration.
B. The customer becomes responsible for the physical database servers after the migration.
C. The customer must patch the RDS host operating system directly.
D. AWS becomes responsible for defining the customer’s database users and permissions.
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** Amazon RDS is a managed service. AWS manages more of the underlying infrastructure and database platform than it does when the customer runs the database software on EC2. * **Why distractors are incorrect:** * **B:** AWS continues to own and manage the physical servers supporting RDS. * **C:** Customers do not directly access or patch the RDS host operating system. * **D:** The customer remains responsible for database users, permissions, and access decisions.Question 9
A company’s Lambda function uses a third-party library with a known vulnerability. Who is responsible for addressing the vulnerable library?
A. AWS, because Lambda manages the execution environment
B. The customer, because the customer supplies and manages the function code and dependencies
C. AWS Support, because all third-party libraries are maintained by AWS
D. Amazon RDS, because database services manage application dependencies
Click to view Answer & Explanation
**Correct Answer:** B **Explanation:** * **Why B is correct:** The customer is responsible for the security of its Lambda code, packages, and dependencies. AWS manages the Lambda service infrastructure, but not customer-provided application libraries. * **Why distractors are incorrect:** * **A:** AWS manages the underlying Lambda infrastructure and execution environment, not customer-provided dependencies. * **C:** AWS Support does not maintain all third-party libraries used in customer applications. * **D:** Amazon RDS is unrelated to managing dependencies in a Lambda function.Question 10
A company is preparing for a compliance audit of an application hosted on AWS. Which TWO statements correctly describe the shared responsibility model? (Select TWO)
A. AWS is responsible for security of the cloud, including the underlying infrastructure.
B. The customer has no security responsibilities when using managed services such as AWS Lambda.
C. The customer is responsible for security in the cloud, including its data and configurations.
D. AWS automatically ensures that every customer application meets all industry regulations.
Click to view Answer & Explanation
**Correct Answers:** A and C **Explanation:** * **Why A is correct:** AWS is responsible for security of the cloud, including the physical facilities, hardware, networking, and foundational infrastructure used to provide AWS services. * **Why C is correct:** Customers are responsible for security in the cloud, including data protection, identity and access management, application security, and service configuration. * **Why distractors are incorrect:** * **B:** Managed services reduce some customer responsibilities, but customers still manage their code, data, permissions, and configurations. * **D:** AWS provides security capabilities and compliance information, but customers remain responsible for configuring their workloads and meeting their own regulatory requirements.Question 11
A company runs a web application on Amazon EC2. The company is responsible for applying security patches to the operating system running on its EC2 instances. Which part of the AWS shared responsibility model does this represent?
A. AWS responsibility for security of the cloud
B. Customer responsibility for security in the cloud
C. AWS responsibility for physical data center security
D. Shared responsibility for AWS global infrastructure
Click to view Answer & Explanation
**Correct Answer:** B **Explanation:** * **Why B is correct:** For Amazon EC2, the customer is responsible for managing and patching the guest operating system, applications, and other software installed on the instance. * **Why A is incorrect:** AWS is responsible for the infrastructure that runs the EC2 service, not the customer-managed guest operating system. * **Why C is incorrect:** AWS secures the physical data centers, facilities, and hardware. * **Why D is incorrect:** AWS manages the underlying global infrastructure, but operating system patching on an EC2 instance is a customer responsibility.Question 12
A financial services company stores sensitive reports in Amazon S3. The company must ensure that only authorized employees can access the reports. Which responsibilities belong to the customer? (Select TWO)
A. Configuring S3 bucket policies and access permissions
B. Securing the physical storage hardware in AWS data centers
C. Managing employee identities and IAM permissions
D. Replacing failed disks in the AWS storage infrastructure
E. Maintaining the AWS global network infrastructure
Click to view Answer & Explanation
**Correct Answers:** A and C **Explanation:** * **Why A is correct:** Customers are responsible for configuring access controls, such as S3 bucket policies, block public access settings, and related permissions. * **Why C is correct:** Customers manage their identities, authentication methods, and IAM permissions. * **Why B is incorrect:** AWS is responsible for protecting the physical storage infrastructure. * **Why D is incorrect:** AWS maintains and replaces failed hardware used to provide the S3 service. * **Why E is incorrect:** AWS is responsible for the underlying networking and global infrastructure.Question 13
A company uses Amazon RDS for a production database. The company wants to understand how its responsibilities differ from those it would have when running the database on Amazon EC2. Which statement is correct?
A. The customer is responsible for patching the operating system on both RDS and EC2.
B. AWS manages the underlying operating system and database platform maintenance for RDS, while the customer manages the guest operating system on EC2.
C. AWS manages the customer’s database users and schema in both RDS and EC2.
D. The customer has no security responsibilities when using RDS.
Click to view Answer & Explanation
**Correct Answer:** B **Explanation:** * **Why B is correct:** Amazon RDS is a managed service. AWS manages much of the underlying infrastructure, operating system, and database platform maintenance. With EC2, the customer manages the guest operating system and software installed on the instance. * **Why A is incorrect:** Customers generally do not patch the underlying operating system for Amazon RDS, but they do manage the guest operating system on EC2. * **Why C is incorrect:** Customers remain responsible for database users, schemas, data, and appropriate database configuration. * **Why D is incorrect:** Customers still manage access, data protection, permissions, and configuration within RDS.Question 14
A company deploys application code using AWS Lambda. The company asks which security tasks remain its responsibility. Which task is the customer responsible for?
A. Securing the AWS data centers that run Lambda
B. Replacing failed physical servers used by Lambda
C. Protecting the application code and managing function permissions
D. Patching the Lambda service’s underlying host operating system
Click to view Answer & Explanation
**Correct Answer:** C **Explanation:** * **Why C is correct:** The customer is responsible for the security of its Lambda code, dependencies, configuration, and permissions, including the function’s IAM execution role. * **Why A is incorrect:** AWS secures the facilities and physical infrastructure. * **Why B is incorrect:** AWS manages the physical servers and hardware supporting Lambda. * **Why D is incorrect:** AWS manages the underlying infrastructure and service operating environment for Lambda.Question 15
An organization is reviewing the AWS shared responsibility model before moving workloads to AWS. Which responsibilities belong to AWS? (Select TWO)
A. Securing AWS data centers and physical facilities
B. Configuring customer IAM policies
C. Maintaining the hardware that supports AWS services
D. Classifying the customer’s business data
E. Patching applications installed by the customer on EC2 instances
Click to view Answer & Explanation
**Correct Answers:** A and C **Explanation:** * **Why A is correct:** AWS is responsible for the physical security of its data centers and facilities. * **Why C is correct:** AWS manages and maintains the hardware and infrastructure used to deliver AWS services. * **Why B is incorrect:** Customers configure their own IAM policies and permissions. * **Why D is incorrect:** Customers are responsible for their data, including classification and appropriate protection. * **Why E is incorrect:** Customers manage applications installed on their EC2 instances.Question 16
A company runs a Linux web server on an Amazon EC2 instance. The company wants to comply with its internal vulnerability management policy. Which activity is primarily the customer’s responsibility?
A. Updating the Linux operating system packages on the instance
B. Patching the physical host server in the AWS data center
C. Securing the AWS Availability Zone
D. Maintaining the power and cooling systems in the data center
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** The customer manages the guest operating system on an EC2 instance and is responsible for applying operating system updates and patches. * **Why B is incorrect:** AWS manages the physical host hardware and its maintenance. * **Why C is incorrect:** AWS is responsible for the infrastructure supporting Availability Zones. * **Why D is incorrect:** AWS manages data center power, cooling, and physical facilities.Question 17
A company uses Amazon RDS and wants to protect its database from unauthorized access. Which two actions are customer responsibilities? (Select TWO)
A. Creating database users with appropriate privileges
B. Replacing failed disks in the RDS infrastructure
C. Configuring security groups and network access controls
D. Patching the underlying RDS host operating system
E. Securing the AWS data center perimeter
Click to view Answer & Explanation
**Correct Answers:** A and C **Explanation:** * **Why A is correct:** Customers manage database users, authentication, roles, and privileges within their RDS databases. * **Why C is correct:** Customers configure network access controls, such as security groups, to control connectivity to an RDS database. * **Why B is incorrect:** AWS manages the underlying storage hardware and replaces failed infrastructure components. * **Why D is incorrect:** AWS manages the underlying operating system and platform maintenance for RDS. * **Why E is incorrect:** AWS is responsible for physical data center security.Question 18
A company uses AWS Lambda to process customer transactions. The company’s developers include third-party libraries in the Lambda deployment package. Who is responsible for ensuring that those libraries do not contain known vulnerabilities?
A. AWS, because Lambda is a fully managed service
B. The customer, because the customer supplies the code and dependencies
C. AWS, because AWS manages all application dependencies
D. The AWS account root user automatically
Click to view Answer & Explanation
**Correct Answer:** B **Explanation:** * **Why B is correct:** The customer is responsible for the security of its application code, deployment packages, and included dependencies, even when using a managed service such as Lambda. * **Why A is incorrect:** Lambda reduces infrastructure management, but it does not transfer responsibility for customer-provided code and libraries to AWS. * **Why C is incorrect:** AWS manages the Lambda service infrastructure and execution environment, not customer-selected application dependencies. * **Why D is incorrect:** The account root user does not automatically perform vulnerability management for application packages.Question 19
A company stores personally identifiable information in Amazon S3. Under the shared responsibility model, which statement best describes data protection responsibilities?
A. AWS is solely responsible for classifying and encrypting all customer data.
B. The customer is responsible for determining appropriate data protection and configuring access controls, while AWS protects the underlying S3 infrastructure.
C. The customer is responsible for securing AWS storage hardware.
D. Amazon S3 automatically makes the customer responsible for physical data center security.
Click to view Answer & Explanation
**Correct Answer:** B **Explanation:** * **Why B is correct:** Customers determine how their data should be classified and protected and configure access controls and encryption options as appropriate. AWS secures the underlying S3 service infrastructure. * **Why A is incorrect:** AWS does not determine the customer’s data classification or all data protection requirements. * **Why C is incorrect:** AWS secures and maintains the physical storage infrastructure. * **Why D is incorrect:** AWS remains responsible for the physical security of its data centers.Question 20
A company is migrating a database from an on-premises environment to Amazon RDS. Which responsibility shifts from the customer to AWS after the migration?
A. Managing database users and permissions
B. Configuring application connectivity to the database
C. Patching the underlying database service infrastructure
D. Protecting the data stored in the database
Click to view Answer & Explanation
**Correct Answer:** C **Explanation:** * **Why C is correct:** Amazon RDS is a managed database service, so AWS manages the underlying infrastructure and much of the platform maintenance, including applicable patching activities. * **Why A is incorrect:** The customer continues to manage database users, roles, and permissions. * **Why B is incorrect:** The customer remains responsible for configuring its applications and network access to the database. * **Why D is incorrect:** The customer remains responsible for protecting its data and configuring appropriate access and encryption controls.Question 21
A company launches an Amazon EC2 instance and notices that AWS provides security groups for controlling network traffic. Who is responsible for configuring the rules in the security group?
A. AWS
B. The customer
C. The AWS data center operator
D. Amazon Route 53
Click to view Answer & Explanation
**Correct Answer:** B **Explanation:** * **Why B is correct:** Customers are responsible for configuring security groups and determining which inbound and outbound traffic is allowed for their EC2 resources. * **Why A is incorrect:** AWS provides and operates the security group capability, but customers configure the rules for their resources. * **Why C is incorrect:** Physical data center operators do not configure customer network access rules. * **Why D is incorrect:** Amazon Route 53 provides DNS services and does not configure EC2 security group rules.Question 22
An organization wants to determine which security controls it must implement after adopting different AWS services. Which statement is most accurate?
A. Customer responsibilities are identical for Amazon EC2, Amazon RDS, and AWS Lambda.
B. Customer responsibilities decrease as AWS provides more managed services, although customers still secure their data and configurations.
C. AWS assumes all customer responsibilities when a managed service is used.
D. Customers are responsible for physical security regardless of the AWS service used.
Click to view Answer & Explanation
**Correct Answer:** B **Explanation:** * **Why B is correct:** The division of responsibilities changes by service. Managed services such as RDS and Lambda reduce infrastructure management, but customers still manage data, access, code, and service configuration. * **Why A is incorrect:** EC2, RDS, and Lambda provide different levels of AWS management. * **Why C is incorrect:** Managed services do not eliminate customer responsibilities. * **Why D is incorrect:** AWS is responsible for physical security of its facilities and infrastructure.Question 23
A company uses Amazon EC2 and wants to ensure that its application data is encrypted at rest. Which action is primarily the customer’s responsibility?
A. Configuring encryption for the applicable EBS volumes
B. Encrypting the physical disks before AWS installs them
C. Securing the AWS storage facility
D. Maintaining the hardware encryption modules used by AWS
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** Customers choose and configure encryption options for resources such as EBS volumes and remain responsible for protecting their data and managing applicable keys. * **Why B is incorrect:** Customers do not physically prepare or install AWS hardware. * **Why C is incorrect:** AWS secures its storage facilities and physical infrastructure. * **Why D is incorrect:** AWS manages the underlying hardware and infrastructure used by its services.Question 24
A healthcare company is reviewing compliance obligations for an application hosted on AWS. Which statement best describes compliance under the shared responsibility model?
A. AWS compliance automatically makes the customer’s application compliant.
B. The customer and AWS share compliance responsibilities, with AWS securing its infrastructure and the customer securing and configuring its workloads.
C. The customer has no compliance responsibilities when using AWS services.
D. The customer is responsible for auditing AWS physical data centers.
Click to view Answer & Explanation
**Correct Answer:** B **Explanation:** * **Why B is correct:** AWS is responsible for compliance and security of the underlying cloud infrastructure, while customers are responsible for their workloads, data, configurations, and applicable regulatory controls. * **Why A is incorrect:** AWS compliance certifications do not automatically make a customer’s application compliant. * **Why C is incorrect:** Customers must still meet requirements for their data and applications. * **Why D is incorrect:** AWS manages and provides information about its physical infrastructure and controls.Question 25
A company uses an Amazon EC2 instance to host a customer portal. Which tasks are the customer’s responsibilities? (Select TWO)
A. Installing and configuring the web server software
B. Managing the physical security of the AWS data center
C. Applying patches to the guest operating system
D. Replacing failed physical network equipment
E. Maintaining the AWS power infrastructure
Click to view Answer & Explanation
**Correct Answers:** A and C **Explanation:** * **Why A is correct:** Customers install and manage applications and software on their EC2 instances. * **Why C is correct:** Customers manage the guest operating system, including security updates and patches. * **Why B is incorrect:** AWS manages the physical security of its facilities. * **Why D is incorrect:** AWS maintains physical networking equipment supporting its services. * **Why E is incorrect:** AWS manages data center power and related infrastructure.Question 26
A company configures an AWS Lambda function with an IAM execution role that grants access to an entire Amazon S3 bucket. What is the customer responsible for in this situation?
A. Reviewing and applying least-privilege permissions to the Lambda execution role
B. Patching the physical servers that execute the Lambda function
C. Securing the AWS Lambda data center
D. Replacing the Lambda service’s network hardware
Click to view Answer & Explanation
**Correct Answer:** A **Explanation:** * **Why A is correct:** Customers configure IAM roles and permissions for their Lambda functions and should apply least-privilege access. * **Why B is incorrect:** AWS manages the physical servers and underlying Lambda infrastructure. * **Why C is incorrect:** AWS secures its facilities and data centers. * **Why D is incorrect:** AWS maintains the hardware and networking infrastructure used by Lambda.Question 27
A company uses Amazon RDS for MySQL instead of installing MySQL on an EC2 instance. Which two responsibilities remain with the customer? (Select TWO)
A. Managing the data stored in the database
B. Maintaining the operating system hosting the RDS service
C. Configuring database access and user permissions
D. Replacing failed database host hardware
E. Installing security patches on the underlying RDS infrastructure
Click to view Answer & Explanation
**Correct Answers:** A and C **Explanation:** * **Why A is correct:** Customers remain responsible for their database data, including its protection, retention, and appropriate access. * **Why C is correct:** Customers manage database users, permissions, and network access configuration. * **Why B is incorrect:** AWS manages the operating system underlying the managed RDS service. * **Why D is incorrect:** AWS manages and replaces failed infrastructure hardware. * **Why E is incorrect:** AWS handles maintenance of the underlying RDS infrastructure.Question 28
An organization wants to understand what AWS means by security “of†the cloud and security “in†the cloud. Which statement is correct?
A. Security of the cloud refers to customer IAM policies, while security in the cloud refers to AWS data centers.
B. Security of the cloud is AWS’s responsibility for infrastructure, while security in the cloud is the customer’s responsibility for workloads and data.
C. Both security of the cloud and security in the cloud are exclusively AWS responsibilities.
D. Both security of the cloud and security in the cloud are exclusively customer responsibilities.
Click to view Answer & Explanation
**Correct Answer:** B **Explanation:** * **Why B is correct:** AWS secures the infrastructure that runs AWS services, while customers secure their data, identities, applications, and configurations within those services. * **Why A is incorrect:** The responsibilities are reversed in this option. * **Why C is incorrect:** Customers retain significant security responsibilities for their workloads. * **Why D is incorrect:** AWS remains responsible for the security of its underlying infrastructure.Question 29
A company uses Amazon S3 and accidentally makes a bucket publicly accessible. Which statement best describes the situation?
A. AWS is responsible because S3 is a managed service.
B. The customer is responsible for configuring the bucket’s access policies and public access settings.
C. AWS must approve every S3 bucket policy before it is applied.
D. Amazon S3 automatically prevents all customer configuration errors.
Click to view Answer & Explanation
**Correct Answer:** B **Explanation:** * **Why B is correct:** Customers are responsible for configuring S3 bucket policies, access controls, and public access settings. * **Why A is incorrect:** AWS manages the S3 infrastructure but does not assume responsibility for customer-configured permissions. * **Why C is incorrect:** AWS does not manually approve every customer bucket policy. * **Why D is incorrect:** Managed services provide security capabilities but do not prevent every customer configuration error.Question 30
A company is comparing Amazon EC2, Amazon RDS, and AWS Lambda to determine where it must perform operating system maintenance. Which comparison is correct?
A. The customer manages the operating system for EC2, while AWS manages the underlying operating environment for RDS and Lambda.
B. The customer manages the operating system for all three services.
C. AWS manages the operating system for EC2, while the customer manages it for RDS and Lambda.
D. The customer manages the physical host operating system for all three services.