CLF-C02 Cloud Concepts Practice Question
According to the AWS Shared Responsibility Model, which of the following is AWS responsible for?
⚠ Common exam trap
Test-takers frequently confuse AWS's responsibility for providing security features (like encryption or IAM) with the customer's responsibility to configure and manage those features, leading them to select options like A, B, or D instead of the correct physical security answer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Physical security of data center facilities
AWS is responsible for the physical security of data center facilities, including access controls, surveillance, and environmental systems. This is a foundational component of the Shared Responsibility Model, where AWS secures the infrastructure that runs all AWS services, while the customer secures their data and configurations within those services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Encrypting customer data stored in Amazon S3
Why it's wrong here
Encrypting customer data in Amazon S3 is a customer responsibility because the customer decides which encryption mechanisms to apply and who can access keys. While AWS supplies features such as SSE-S3, SSE-KMS, and client-side encryption, the customer must configure bucket defaults and manage customer-managed keys when used. AWS cannot assume responsibility for data protection choices that are unique to each workload.
- ✗
Configuring security groups for EC2 instances
Why it's wrong here
Configuring security groups for EC2 instances is a customer responsibility because these virtual firewalls implement the customer's intended network traffic rules. AWS provides the security group feature and a default initial state, but a customer must define inbound and outbound rules, associate groups with instances, and manage updates based on application architecture. AWS does not know the application requirements, so it cannot configure security groups on the customer's behalf.
- ✓
Physical security of data center facilities
Why this is correct
AWS is fully responsible for the physical security of data centers as part of the 'security of the cloud' under the shared responsibility model. This includes perimeter defenses, access controls, environmental systems, and monitoring personnel, all operated by AWS. Customers have no physical access or administrative control over these facilities, so this is never listed among customer responsibilities.
- ✗
Managing IAM user access policies
Why it's wrong here
Managing IAM user access policies is a customer responsibility because AWS only provides the identity and access management service, not the policies. A customer defines users, groups, roles, permission boundaries, and service control policies (where applicable), and must grant least-privilege permissions. AWS neither creates nor maintains customer identities, and any misconfiguration is the customer's accountability under 'security in the cloud'.
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.