Question 104 of 988
What Is the AWS Shared Responsibility Model?
A company hosts a web application on an Amazon EC2 instance. The company installs its own application software and configures the operating system. The company also uses AWS Key Management Service (AWS KMS) to create a customer-managed key to encrypt data on the Amazon Elastic Block Store (Amazon EBS) volume attached to the instance. According to the AWS shared responsibility model, which of the following is the responsibility of AWS?
Quick Answer
The answer is AWS is responsible for ensuring the physical security of the data center where the Amazon EC2 instance runs. This is correct because the AWS shared responsibility model divides duties into security of the cloud and security in the cloud; AWS handles the former, which includes physical hardware, networking, and facilities, while the customer manages the latter, such as guest operating systems, application software, and customer-managed keys like those from AWS KMS. On the AWS Certified Cloud Practitioner CLF-C02 exam, this distinction is frequently tested to ensure you understand that no matter what the customer configures—even encryption on EBS volumes—AWS never cedes control of the underlying physical infrastructure. A common trap is confusing data encryption responsibilities with physical security; remember that AWS owns the building, you own the lock. For a quick memory tip, think “AWS owns the box, you own the bits.”
⚠ Common exam trap
Watch out — candidates often confuse 'encryption at rest' as an AWS responsibility, but the shared responsibility model clearly assigns the management of customer-managed keys and the decision to encrypt to the customer, while AWS only provides the encryption infrastructure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ensuring the physical security of the data center where the Amazon EC2 instance runs.
Under the AWS shared responsibility model, AWS is responsible for the security of the cloud, which includes the physical security of data centers, hardware, networking, and facilities where EC2 instances run. This is a foundational layer that customers cannot manage or control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Encrypting the data on the Amazon EBS volume using the customer-managed key.
Why it's wrong here
This is a customer responsibility. The customer creates and manages the KMS key and must configure the EBS volume to use that key for encryption. AWS provides the infrastructure for encryption, but the customer controls the key and the encryption settings.
When this WOULD be correct
If the question asked which task is the customer's responsibility when using AWS KMS with EBS encryption, then encrypting data with a customer-managed key would be correct, as the customer manages the key and initiates encryption.
- ✗
Patching the operating system of the Amazon EC2 instance.
Why it's wrong here
This is a customer responsibility. The customer manages the guest operating system, including applying patches and updates. AWS is responsible only for the hypervisor layer and underlying hardware.
When this WOULD be correct
If the question asked about patching the hypervisor or underlying infrastructure that AWS manages, then AWS would be responsible. For example, 'Which of the following is AWS responsible for patching?'
- ✓
Ensuring the physical security of the data center where the Amazon EC2 instance runs.
Why this is correct
This is an AWS responsibility. AWS operates and controls the physical security of its data centers, including access controls, surveillance, and environmental systems. This falls under 'security of the cloud.'
- ✗
Configuring the security group rules to restrict traffic to the Amazon EC2 instance.
Why it's wrong here
This is a customer responsibility. Security groups act as virtual firewalls, and the customer must define the ingress and egress rules. AWS provides the mechanism, but the configuration is the customer's task.
When this WOULD be correct
This option would be correct if the question asked which task is the customer's responsibility, or if it asked about AWS responsibilities for a managed service like Amazon RDS where AWS manages the underlying security groups.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓Ensuring the physical security of the data center where the Amazon EC2 instance runs.Correct answer▾
Why this is correct
This is an AWS responsibility. AWS operates and controls the physical security of its data centers, including access controls, surveillance, and environmental systems. This falls under 'security of the cloud.'
✗Encrypting the data on the Amazon EBS volume using the customer-managed key.Wrong answer — click to see why▾
Why this is wrong here
Encrypting data on the EBS volume using a customer-managed key is a customer responsibility under the shared responsibility model, as the customer controls the key and the encryption configuration.
★ When this WOULD be the correct answer
If the question asked which task is the customer's responsibility when using AWS KMS with EBS encryption, then encrypting data with a customer-managed key would be correct, as the customer manages the key and initiates encryption.
Why candidates choose this
Candidates may confuse the shared responsibility model, thinking that AWS handles all encryption tasks, or they may misinterpret that using a customer-managed key shifts responsibility to AWS.
✗Patching the operating system of the Amazon EC2 instance.Wrong answer — click to see why▾
Why this is wrong here
Patching the operating system is the customer's responsibility under the AWS shared responsibility model, as the customer controls the guest OS and installed software.
★ When this WOULD be the correct answer
If the question asked about patching the hypervisor or underlying infrastructure that AWS manages, then AWS would be responsible. For example, 'Which of the following is AWS responsible for patching?'
Why candidates choose this
Candidates may confuse OS patching with infrastructure patching, or assume that because AWS provides the EC2 service, it handles all patching.
✗Configuring the security group rules to restrict traffic to the Amazon EC2 instance.Wrong answer — click to see why▾
Why this is wrong here
Configuring security group rules is a customer responsibility under the AWS shared responsibility model, as it involves managing network access controls within the customer's virtual private cloud.
★ When this WOULD be the correct answer
This option would be correct if the question asked which task is the customer's responsibility, or if it asked about AWS responsibilities for a managed service like Amazon RDS where AWS manages the underlying security groups.
Why candidates choose this
Candidates may confuse security group configuration as an AWS responsibility because AWS provides the infrastructure, but they overlook that customers control the rules.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on CLF-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is migrating an on-premises application to AWS. The application will run on Amazon EC2 instances and use an Amazon RDS for MySQL database. The security team needs to understand which security controls remain the company's responsibility after the migration. Under the AWS Shared Responsibility Model, which of the following is the customer's responsibility?
medium- A.Patching the MySQL database engine for the Amazon RDS instance.
- ✓ B.Patching the guest operating system on the Amazon EC2 instances.
- C.Providing physical security at the AWS data center facilities.
- D.Replacing failed network switches in the AWS global network.
Why B: Under the AWS Shared Responsibility Model, the customer is responsible for patching the guest operating system on Amazon EC2 instances because EC2 is an Infrastructure as a Service (IaaS) offering where AWS manages the hypervisor and physical infrastructure, but the customer has full control over the OS, applications, and configurations. In contrast, for Amazon RDS, AWS handles patching of the database engine (e.g., MySQL) and the underlying OS, making option A AWS's responsibility. Physical security at AWS data centers is always AWS's responsibility, not the customer's.
Variation 2. A company is migrating a three-tier web application to AWS. The application will run on Amazon EC2 instances using a custom Linux distribution, and a self-managed MySQL database will be installed on the same instances. The company's security team needs to understand which security responsibilities belong to AWS and which belong to the company under the AWS Shared Responsibility Model. According to this model, who is responsible for applying operating system security patches to the EC2 instances and for updating the MySQL database software?
medium- A.AWS is responsible for both the operating system patches and the MySQL database updates.
- ✓ B.The company is responsible for both the operating system patches and the MySQL database updates.
- C.AWS is responsible for the operating system patches, and the company is responsible for the MySQL database updates.
- D.The company is responsible for the operating system patches, and AWS is responsible for the MySQL database updates.
Why B: Under the AWS Shared Responsibility Model, AWS is responsible for the security of the cloud (e.g., physical infrastructure, hypervisor), while the customer is responsible for security in the cloud (e.g., guest OS, applications, and data). Since the company is using a custom Linux distribution on EC2 instances and installing a self-managed MySQL database, both the operating system patches and the MySQL database updates fall under the customer's responsibility. AWS does not manage or patch the guest operating system or any software installed by the customer on EC2 instances.
Variation 3. A startup is migrating a web application to AWS. The application runs on Amazon EC2 instances that use a custom Amazon Machine Image (AMI) with the company's proprietary software. The security team needs to understand which security tasks the company must perform. Under the AWS Shared Responsibility Model, which of the following is the customer's responsibility?
medium- A.Patching the hypervisor that hosts the EC2 instances
- ✓ B.Configuring security groups to control inbound traffic to the instances
- C.Physical security of the data center where the instances run
- D.Maintaining the underlying network infrastructure
Why B: Configuring security groups is a customer responsibility because security groups act as a virtual firewall for EC2 instances, controlling inbound and outbound traffic at the instance level. Under the AWS Shared Responsibility Model, the customer is responsible for configuring network access controls, while AWS manages the underlying infrastructure. This includes defining rules based on IP protocols, ports, and source/destination CIDR ranges.
Last reviewed: Jun 11, 2026
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.