CLF-C02 Cloud Concepts Practice Question
According to the AWS Shared Responsibility Model, which of the following is the customer's responsibility when using AWS Lambda?
⚠ Common exam trap
A common mix-up: candidates confuse operational responsibilities (like patching or scaling) with customer responsibilities, assuming they must manage runtime updates or scaling configuration, when in fact AWS handles these automatically for Lambda.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Writing secure function code and managing IAM permissions for the function
Under the AWS Shared Responsibility Model, AWS manages the security of the cloud, including the Lambda execution environment, runtime, and underlying servers. The customer is responsible for security in the cloud, which includes writing secure function code and managing IAM permissions to control access to the function and its resources. Option C correctly identifies this customer responsibility.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Patching the Lambda execution environment and runtime
Why it's wrong here
Patching the Lambda execution environment is the provider's responsibility under the shared responsibility model. AWS maintains the runtime, applies security updates to the underlying Firecracker microVM, and updates the execution environment automatically. Customers never patch the Lambda infrastructure; at most, they choose a newer runtime version when AWS deprecates an older one.
- ✗
Managing the underlying servers that run Lambda functions
Why it's wrong here
Lambda is a fully serverless service, so no physical or virtual servers are exposed to the customer. AWS manages the server fleet, including capacity provisioning, hardware maintenance, and the hypervisor layer that isolates functions. The customer has no ability to log in to or configure any underlying server.
- ✓
Writing secure function code and managing IAM permissions for the function
Why this is correct
Customers are responsible for the security of the function code itself, such as input validation, secrets handling, and dependency management, as well as the IAM role and resource policies that determine what the function can access. A Lambda function's execution role grants permissions to AWS services and resources; misconfigured IAM policies or insecure code create security risks. This is the part of the shared responsibility model that belongs to the customer.
- ✗
Ensuring Lambda scales automatically during traffic spikes
Why it's wrong here
Lambda's automatic scaling is a built-in capability managed by AWS; the service scales by running multiple concurrent executions of your function in response to incoming events. Customers don't configure scaling policies, provision capacity, or manage concurrency limits at the infrastructure level. Although you can set reserved concurrency to control throughput or costs, the actual scaling mechanism is fully AWS-managed.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This CLF-C02 question is part of Courseiva's 988-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.