CLF-C02 Cloud Concepts Practice Question
A company has deployed a web application on Amazon EC2 instances. The company's security team wants to ensure that the underlying host operating system is patched against a newly discovered vulnerability. According to the AWS Shared Responsibility Model, who is responsible for applying the patch to the host operating system?
⚠ Common exam trap
The trap here is that candidates mistakenly apply the IaaS model's general rule (customer manages the OS) to the host OS, forgetting that in virtualized EC2, the host OS is part of the hypervisor layer managed solely by AWS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS, because the hypervisor and host OS are part of the 'Security of the Cloud'.
Under the AWS Shared Responsibility Model, AWS is responsible for the security of the cloud, which includes the physical infrastructure, hypervisor, and host operating system that runs EC2 instances. When a vulnerability is discovered in the host OS (the OS that runs the hypervisor and manages the physical hardware), AWS must apply the patch because the customer has no access to or control over the host OS. The customer is only responsible for patching the guest OS (the OS running inside the EC2 instance) and any applications deployed on it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The company, because patches for underlying infrastructure are always the customer's responsibility in EC2.
Why it's wrong here
This is incorrect because it conflates the host OS with the guest OS. Although EC2 is an Infrastructure as a Service (IaaS) offering where customers manage the guest OS, the underlying infrastructure—including the host OS and hypervisor—is always managed by AWS. AWS patches the host OS as part of its responsibility for the physical and virtualization layer, and the customer never has access to or responsibility for patching that host OS. Therefore, the statement that the company must patch underlying infrastructure is false.
When this WOULD be correct
This option would be correct if the question asked about patching the guest operating system on an EC2 instance, or if the vulnerability was in an application or data that the customer manages. For example: 'Who is responsible for applying security patches to the operating system running on an EC2 instance?'
- ✓
AWS, because the hypervisor and host OS are part of the 'Security of the Cloud'.
Why this is correct
AWS is responsible for patching the host OS because it is part of the underlying cloud infrastructure, which falls under the 'Security of the Cloud' in the AWS Shared Responsibility Model. The hypervisor, physical servers, and host operating system are managed exclusively by AWS, and AWS must apply security patches to these components. Customers only manage the guest operating system running inside their EC2 instance, not the host OS, so this option correctly identifies AWS as the responsible party.
- ✗
The company, because EC2 is an Infrastructure as a Service (IaaS) offering and the customer manages the OS.
Why it's wrong here
This is a common misunderstanding. Although customers manage the guest OS on EC2 instances, the host OS is part of the underlying cloud infrastructure and is managed by AWS. The customer's OS management responsibility is limited to the guest OS.
When this WOULD be correct
This option would be correct if the question asked about patching the guest operating system of an EC2 instance (e.g., Amazon Linux, Windows Server) or if the vulnerability was in the application or middleware running on the instance. In those cases, the customer is responsible for patching the OS and software they manage.
- ✗
Both the company and AWS share responsibility equally for host OS patching.
Why it's wrong here
This is incorrect because responsibility is not shared equally; it is divided by component. AWS has sole responsibility for patching the host OS, while the customer has sole responsibility for patching the guest OS, the applications, and the data within the instance. There is no joint or equal responsibility for any single layer of the stack, and specifically the host OS patching is owned entirely by AWS. Thus, saying both 'share responsibility equally' misrepresents the clear division of the Shared Responsibility Model.
When this WOULD be correct
This option would be correct in a scenario where the question asks about patching the guest operating system of an EC2 instance, and the answer choices include shared responsibility for that specific component. In that case, both AWS (for the underlying infrastructure) and the customer (for the guest OS) share responsibility, but not equally for the same layer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS, because the hypervisor and host OS are part of the 'Security of the Cloud'.Correct answer▾
Why this is correct
AWS is responsible for patching the host OS because it is part of the underlying cloud infrastructure, which falls under the 'Security of the Cloud' in the AWS Shared Responsibility Model. The hypervisor, physical servers, and host operating system are managed exclusively by AWS, and AWS must apply security patches to these components. Customers only manage the guest operating system running inside their EC2 instance, not the host OS, so this option correctly identifies AWS as the responsible party.
✗The company, because patches for underlying infrastructure are always the customer's responsibility in EC2.Wrong answer — click to see why▾
Why this is wrong here
Under the AWS Shared Responsibility Model, AWS is responsible for patching the host operating system, which is part of the 'Security of the Cloud'. The customer is responsible for patching the guest OS, not the host OS.
★ When this WOULD be the correct answer
This option would be correct if the question asked about patching the guest operating system on an EC2 instance, or if the vulnerability was in an application or data that the customer manages. For example: 'Who is responsible for applying security patches to the operating system running on an EC2 instance?'
Why candidates choose this
Candidates often confuse the customer's responsibility for the guest OS with the host OS, or they assume that because EC2 is IaaS, all patching falls on the customer, not realizing AWS manages the underlying host.
✗The company, because EC2 is an Infrastructure as a Service (IaaS) offering and the customer manages the OS.Wrong answer — click to see why▾
Why this is wrong here
In this question, the vulnerability is on the host operating system (hypervisor layer), not the guest OS. Under the AWS Shared Responsibility Model, AWS is responsible for patching the host OS, which is part of 'Security of the Cloud'. Option C incorrectly assigns this responsibility to the customer.
★ When this WOULD be the correct answer
This option would be correct if the question asked about patching the guest operating system of an EC2 instance (e.g., Amazon Linux, Windows Server) or if the vulnerability was in the application or middleware running on the instance. In those cases, the customer is responsible for patching the OS and software they manage.
Why candidates choose this
Candidates often confuse the customer's responsibility for patching the guest OS (which is true for IaaS) with the host OS. They may overgeneralize that all OS patching in EC2 is the customer's job, not realizing the shared responsibility model distinguishes between host and guest.
✗Both the company and AWS share responsibility equally for host OS patching.Wrong answer — click to see why▾
Why this is wrong here
The AWS Shared Responsibility Model assigns host OS patching solely to AWS for EC2; the customer is responsible for guest OS patching. Shared responsibility does not mean equal responsibility for the same component.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the question asks about patching the guest operating system of an EC2 instance, and the answer choices include shared responsibility for that specific component. In that case, both AWS (for the underlying infrastructure) and the customer (for the guest OS) share responsibility, but not equally for the same layer.
Why candidates choose this
Candidates may think that because EC2 is an IaaS service, all security responsibilities are shared equally, misunderstanding that the division of responsibility is specific to each layer (host vs. guest).
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.