CLF-C02 Cloud Concepts Practice Question
Under the AWS Shared Responsibility Model, which of the following is the customer's responsibility when using Amazon RDS?
⚠ Common exam trap
A common mix-up: candidates confuse the customer's responsibility for managing database user accounts with AWS's responsibility for patching the database engine, leading them to incorrectly select option D as the customer's task.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Managing database user accounts and controlling data access
Under the AWS Shared Responsibility Model, AWS manages the infrastructure, including the underlying EC2 instances, physical storage, and database engine minor version patches for Amazon RDS. The customer is responsible for managing database user accounts, controlling data access, and securing the data itself, as these are within the customer's control and not managed by AWS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Patching the underlying EC2 instances hosting the database
Why it's wrong here
Patching the underlying EC2 instances that host an Amazon RDS database is an AWS responsibility, not a customer one. Because RDS is a fully managed service, the EC2 instances are abstracted from the customer, and AWS applies operating system and infrastructure patches to those host instances automatically. Customers never have direct access to these EC2 instances, so they cannot and need not patch them. Therefore, this task falls outside the customer's shared responsibility model for RDS.
- ✗
Managing the physical storage media and hardware
Why it's wrong here
Managing the physical storage media and hardware, such as disk drives, SSDs, and the physical servers that run the RDS database, is entirely AWS's responsibility under the shared responsibility model. Customers have no physical access to AWS data centers, and the infrastructure is abstracted away by the RDS service. Hardware lifecycle, replacement, and maintenance are handled by AWS, not the customer. Thus, this is a wrong answer because it is not a customer responsibility.
- ✓
Managing database user accounts and controlling data access
Why this is correct
Managing database user accounts and controlling data access is a customer responsibility in Amazon RDS. Even though AWS manages the underlying infrastructure and engine, the customer is responsible for creating database users, granting privileges, and implementing access controls (e.g., passwords, IAM authentication, VPC security groups, and network ACLs). This aligns with the customer's control over data and who can access it, as defined by the AWS shared responsibility model. It is the correct answer because data governance and access management remain firmly in the customer's domain.
- ✗
Applying database engine minor version patches
Why it's wrong here
Applying database engine minor version patches is largely handled by AWS in Amazon RDS, though customers control when patches are applied via maintenance windows. AWS automatically applies minor version patches during the scheduled maintenance window, and in many cases, you can opt for automatic minor version upgrades. The customer is not responsible for manually installing these patches; they only review and approve the maintenance window timing. Therefore, this is not a correct answer because it is not a primary customer responsibility.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.