AWS CLF-C02 Exam Notes
Domain 2: Security and Compliance
Task Statement 2.1: Understand the AWS Shared Responsibility Model
20 Practice Questions (AWS exam style, Foundation level)
Question 1
Which of the following best describes the AWS shared responsibility model?
A. AWS is responsible for all security; customers only manage billing.
B. Customers are responsible for security of the cloud; AWS is responsible for security in the cloud.
C. AWS is responsible for security of the cloud; customers are responsible for security in the cloud.
D. Security responsibilities are identical for every AWS service.
Click to reveal answer
**Correct Answer: C** **Explanation:** The AWS shared responsibility model clearly states that AWS is responsible for security **of** the cloud (infrastructure, hardware, software, networking, and facilities that run AWS services), while the customer is responsible for security **in** the cloud (customer data, applications, identity and access management, operating system, network and firewall configuration, client-side and server-side encryption, etc.). **Exam tip / trap:** Watch for the exact wording “of the cloud” vs “in the cloud.” This is one of the most frequently tested phrases.Question 2
According to the AWS shared responsibility model, who is responsible for the physical security of the data centers that host AWS services?
A. The customer
B. AWS
C. Both AWS and the customer equally
D. The customer’s compliance auditor
Click to reveal answer
**Correct Answer: B** **Explanation:** AWS is solely responsible for the physical security of its global infrastructure, including data centers, hardware, and facilities. Customers have no access to or control over these physical assets. **Exam tip:** Physical security, hardware, and global infrastructure (Regions, AZs, edge locations) are always AWS’s responsibility.Question 3
A company is running a MySQL database on Amazon RDS. Who is responsible for applying security patches to the database engine?
A. The customer
B. AWS
C. Both AWS and the customer
D. The database vendor (Oracle/MySQL)
Click to reveal answer
**Correct Answer: B** **Explanation:** Amazon RDS is a managed service. AWS is responsible for patching the underlying operating system and the database engine. The customer is still responsible for the data, network access control, and encryption configuration. **Exam tip / trap:** Contrast this with running MySQL on Amazon EC2 — the customer would then be responsible for OS and database patching.Question 4
A company is running a MySQL database on an Amazon EC2 instance. Who is responsible for applying security patches to the operating system and the database engine?
A. AWS
B. The customer
C. Both AWS and the customer
D. Only the database vendor
Click to reveal answer
**Correct Answer: B** **Explanation:** Amazon EC2 is an Infrastructure-as-a-Service (IaaS) offering. The customer is responsible for the guest operating system, applications, and any software running on the instance, including database patching. **Exam tip:** Remember the rule — the more control you have (EC2), the more responsibility you assume.Question 5
Which of the following are customer responsibilities under the AWS shared responsibility model? (Choose TWO.)
A. Physical security of AWS data centers
B. Patching the guest operating system on Amazon EC2 instances
C. Managing the hypervisor
D. Configuring security groups and network ACLs
E. Maintaining the AWS global infrastructure
Click to reveal answer
**Correct Answer: B and D** **Explanation:** - Customers must patch the OS and applications on EC2. - Customers configure network security (security groups, NACLs, firewalls). AWS handles physical security, the hypervisor, and the global infrastructure. **Exam tip:** “Choose TWO” questions are common. Always select the exact number requested.Question 6
Under the AWS shared responsibility model, who is responsible for encrypting data at rest stored in Amazon S3?
A. AWS only
B. The customer only
C. Both AWS and the customer (customer chooses encryption; AWS provides the tools)
D. Neither — encryption is not required
Click to reveal answer
**Correct Answer: C** **Explanation:** AWS provides encryption features (SSE-S3, SSE-KMS, SSE-C, client-side encryption). The customer is responsible for enabling and managing encryption of their data. This is a shared responsibility area for many storage services. **Exam tip:** Encryption (both at rest and in transit) is almost always a customer responsibility, even though AWS supplies the tools.Question 7
Which service requires the customer to take the greatest amount of security responsibility?
A. Amazon RDS
B. AWS Lambda
C. Amazon DynamoDB
D. Amazon EC2
Click to reveal answer
**Correct Answer: D** **Explanation:** Amazon EC2 gives customers the most control and therefore the most responsibility (OS patching, application security, network configuration, etc.). Managed services like RDS, Lambda, and DynamoDB shift more responsibility to AWS. **Exam tip:** Know the spectrum: EC2 (most customer responsibility) → RDS → Lambda/DynamoDB (least customer responsibility).Question 8
A company uses AWS Lambda for its serverless application. Who is responsible for patching the operating system and runtime environment?
A. The customer
B. AWS
C. Both equally
D. The language runtime provider (e.g., Node.js, Python)
Click to reveal answer
**Correct Answer: B** **Explanation:** AWS Lambda is a fully managed serverless service. AWS is responsible for the underlying infrastructure, operating system, and runtime patching. The customer is responsible for the function code, IAM permissions, and any sensitive data handled by the function. **Exam tip:** For Lambda, remember “AWS manages the platform; you manage the code.”Question 9
According to the AWS shared responsibility model, which of the following is always an AWS responsibility regardless of the service used?
A. Configuring IAM policies
B. Encrypting customer data
C. Maintaining the physical hardware and facilities
D. Managing application-level access control
Click to reveal answer
**Correct Answer: C** **Explanation:** Physical hardware, data centers, and the global infrastructure are always AWS’s responsibility. IAM policies, data encryption, and application access control are customer responsibilities.Question 10
Which of the following statements correctly describe responsibilities that can shift depending on the AWS service used? (Choose TWO.)
A. Patching of the database engine
B. Physical security of data centers
C. Management of the guest operating system
D. Responsibility for the AWS Regions and Availability Zones
E. Ownership of the underlying hypervisor
Click to reveal answer
**Correct Answer: A and C** **Explanation:** - Database engine patching: AWS for RDS, customer for EC2. - Guest OS management: customer for EC2, AWS for many managed services. Physical security, Regions/AZs, and hypervisor are always AWS’s responsibility. **Exam tip:** The exam loves comparing EC2 vs RDS vs Lambda for shifting responsibilities.Question 11
Who is responsible for configuring Identity and Access Management (IAM) users, groups, roles, and policies?
A. AWS
B. The customer
C. Both AWS and the customer
D. AWS Support
Click to reveal answer
**Correct Answer: B** **Explanation:** IAM configuration and identity management are always a customer responsibility. AWS provides the IAM service, but the customer decides who can access what. **Exam tip:** “Customer data” and “identity & access management” are classic customer responsibilities.Question 12
A company stores sensitive data in Amazon S3 and Amazon EBS. Under the shared responsibility model, who is responsible for ensuring the data is encrypted?
A. AWS automatically encrypts all data
B. The customer
C. AWS Support must enable encryption
D. Encryption is not part of the shared responsibility model
Click to reveal answer
**Correct Answer: B** **Explanation:** Customers are responsible for protecting their data, including enabling encryption at rest and in transit. AWS provides the encryption features, but the customer must configure and manage them.Question 13
Which of the following are AWS responsibilities under the shared responsibility model? (Choose THREE.)
A. Managing network and firewall configuration for customer applications
B. Securing the AWS global infrastructure
C. Patching the hypervisor
D. Protecting customer data stored in Amazon S3
E. Managing Availability Zones and edge locations
F. Configuring security groups for EC2 instances
Click to reveal answer
**Correct Answer: B, C, and E** **Explanation:** AWS is responsible for: - Security of the global infrastructure - Hypervisor and foundational software - Regions, Availability Zones, and edge locations Customers handle security groups, firewall rules, and their own data.Question 14
When using Amazon DynamoDB, who is responsible for managing the underlying servers and operating system?
A. The customer
B. AWS
C. Both
D. The customer’s database administrator
Click to reveal answer
**Correct Answer: B** **Explanation:** Amazon DynamoDB is a fully managed NoSQL database service. AWS handles all infrastructure, servers, OS patching, and scaling. The customer focuses on data modeling, access patterns, and IAM.Question 15
Which statement is true about the AWS shared responsibility model?
A. The model is identical for every AWS service.
B. Customer responsibility decreases as the service becomes more managed.
C. AWS is responsible for customer application code.
D. Customers are responsible for the physical networking cables in AWS data centers.
Click to reveal answer
**Correct Answer: B** **Explanation:** As services move from IaaS (EC2) → PaaS (RDS) → Serverless/FaaS (Lambda) → fully managed (DynamoDB, S3), customer responsibility decreases and AWS responsibility increases. **Exam tip:** This “shift” concept is explicitly called out in the exam guide.Question 16
A company needs to ensure that network traffic to its Amazon EC2 instances is encrypted using SSL/TLS. Who is responsible for implementing this?
A. AWS
B. The customer
C. AWS Certificate Manager automatically handles it
D. The internet service provider
Click to reveal answer
**Correct Answer: B** **Explanation:** Protecting network traffic (including SSL/TLS certificates and encryption in transit) is a customer responsibility. AWS provides tools such as ACM, but the customer must configure and use them.Question 17
Which of the following is a shared responsibility between AWS and the customer?
A. Physical access to data centers
B. Decommissioning of storage devices
C. Configuration of the guest operating system firewall on EC2
D. Awareness and training (some aspects of security awareness)
Click to reveal answer
**Correct Answer: D** **Explanation:** While most items are clearly divided, some high-level areas such as security awareness and training can have shared elements. However, the classic shared areas often referenced are encryption and certain configuration choices. Physical security and media decommissioning are purely AWS. **Note:** In strict exam terms, the cleanest “shared” examples are often encryption settings and service configuration choices.Question 18
Who is responsible for performing regular backups of data stored in an Amazon RDS database?
A. AWS automatically backs up everything permanently
B. The customer
C. AWS is responsible for automated backups; the customer is responsible for defining backup retention and testing restores
D. Backups are not required in the cloud
Click to reveal answer
**Correct Answer: C** **Explanation:** AWS provides automated backup features for RDS, but the customer is responsible for enabling them, setting retention periods, and ensuring their backup and restore strategy meets business requirements. Customer data protection remains a customer responsibility.Question 19
Which of the following tasks is the customer responsible for when using Amazon EC2? (Choose TWO.)
A. Maintaining the physical host hardware
B. Installing and patching antivirus software on the instance
C. Managing the AWS hypervisor
D. Configuring the instance’s operating system firewall
E. Replacing failed hard drives in the data center
Click to reveal answer
**Correct Answer: B and D** **Explanation:** On EC2 the customer owns everything from the guest OS upward, including antivirus, OS firewall/security configuration, and application security. Hardware and hypervisor remain AWS’s responsibility.Question 20
A solutions architect is explaining the shared responsibility model to a new team. Which statement should they use to correctly summarize it?
A. “AWS takes care of all security so we don’t have to worry about anything.”
B. “We are responsible for security of the cloud; AWS is responsible for security in the cloud.”
C. “AWS is responsible for security of the cloud; we are responsible for security in the cloud. Our responsibilities change depending on whether we use EC2, RDS, or Lambda.”
D. “Security responsibilities never change no matter which service we use.”
Click to reveal answer
**Correct Answer: C** **Explanation:** This statement correctly captures both the core principle (“of the cloud” vs “in the cloud”) and the important nuance that responsibilities shift based on the service abstraction level (EC2 vs RDS vs Lambda, etc.). **Exam tip:** The best answers usually include both the classic phrase and the concept that responsibility varies by service.End of 20 Questions for Task Statement 2.1
Key Takeaways for the Exam
- Memorize: AWS = security OF the cloud | Customer = security IN the cloud
- Responsibility shifts: EC2 (customer does more) → RDS → Lambda/DynamoDB (AWS does more)
- Always customer: data, encryption, IAM, OS (on EC2), network configs, applications
- Always AWS: physical infrastructure, hardware, hypervisor, Regions/AZs/edge locations