CCNA Security and Compliance Questions

AWS KMS is a service for creating and managing encryption keys, not for provisioning or renewing SSL/TLS certificates. It does not automate certificate renewal or integrate with ALB for HTTPS termination.

AWS WAF is a web application firewall that protects against common web exploits, not a service for managing SSL/TLS certificates. It does not provision or renew certificates.

AWS Secrets Manager is designed to securely store and rotate secrets like database credentials, API keys, and other sensitive configuration data, not to manage SSL/TLS certificates for load balancers. It does not automatically provision or renew certificates for use with AWS services like ALB.

IAM roles with MFA control user access but cannot enforce preventive restrictions across all accounts, including root users, in an AWS Organization.

AWS Config rules with automatic remediation are detective and reactive, not preventive. They can detect noncompliant changes and trigger remediation actions, but they cannot prevent root users or others from making changes in the first place.

AWS Shield Advanced is a DDoS protection service, not a preventive control for restricting actions like disabling CloudTrail or deleting S3 bucket policies across all accounts in an organization.

IAM policies are attached to IAM users, groups, or roles within a single account and cannot be centrally applied across all member accounts in an organization. They also cannot prevent actions by the root user.

AWS Config rules with automatic remediation can detect and fix non-compliant S3 public access settings, but they cannot prevent the root user from making changes, and they apply only after the fact, not as a preventive control. Additionally, they are not centrally managed across all accounts in an organization without additional setup.

AWS Trusted Advisor provides best-practice recommendations but cannot enforce policies or prevent actions like disabling S3 Block Public Access across accounts.

AWS Config is a detective control that evaluates and reports on compliance, but it does not prevent the creation of public buckets. It can only detect and alert after a bucket has been made public, not block the action proactively.

An IAM policy with a condition denying s3:PutBucketPolicy for actions granting public access is not a preventive control that applies automatically to all buckets without changes to individual bucket policies. It only restricts who can set bucket policies, but does not prevent existing public access or apply to buckets created by users who are not bound by that IAM policy.

GuardDuty is a detective control that identifies threats and generates findings, not a preventive control that blocks public access. It cannot prevent S3 buckets from being configured with public access; it only alerts after the fact.

AWS Trusted Advisor provides best practice checks and recommendations, but it does not continuously evaluate IAM user access key age against a custom 90-day policy and generate findings. It offers a limited set of predefined checks, not custom compliance rules.

Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, not for evaluating IAM user access key age or compliance with rotation policies.

AWS IAM Access Analyzer identifies resources shared with external entities, not the age of IAM user access keys. It does not evaluate access key rotation compliance.

AWS Config is a service for evaluating resource configurations against desired policies, not for aggregating security findings from GuardDuty, Inspector, and Macie or providing a security score and compliance tracking against CIS AWS Foundations.

Amazon Detective is designed for root-cause analysis of security findings, not for aggregating findings from multiple services or providing a security score and compliance tracking.

AWS Security Hub aggregates findings from multiple services but does not itself track configuration history or provide compliance rules for security group changes. It cannot detect unrestricted RDP access or maintain a configuration history for forensic analysis.

AWS CloudTrail records API activity for governance and audit, but it does not evaluate security group rules against compliance rules or send notifications for non-compliant configurations. It also does not track configuration history of resources like security groups; it tracks API calls, not resource state changes.

AWS Certificate Manager manages SSL/TLS certificates, not secure shell sessions. It does not provide remote access to EC2 instances.

AWS CloudHSM provides hardware security modules for cryptographic key storage, not remote shell access to EC2 instances. It cannot establish SSH or RDP sessions.

Amazon GuardDuty is a threat detection service that monitors for malicious activity, not a tool for establishing secure shell sessions to manage EC2 instances.

AWS Config is a service for assessing, auditing, and evaluating configurations of AWS resources, not for providing compliance reports like SOC 2 or PCI DSS AOC. The question specifically asks for obtaining these documents directly from AWS, which is the function of AWS Artifact.

AWS Audit Manager helps audit evidence collection and report generation, but it does not provide direct access to AWS compliance reports like SOC 2 or PCI DSS AOC. The question specifically asks for obtaining these documents directly from AWS, which is the function of AWS Artifact.

AWS Trusted Advisor provides recommendations for cost optimization, performance, security, and fault tolerance, but it does not provide compliance reports like SOC 2 or PCI DSS AOC.

AWS Security Hub provides a comprehensive view of security alerts and compliance status across accounts, but it does not offer downloadable PDFs of AWS compliance reports like PCI DSS. The question specifically requires an official document that can be downloaded as a PDF, which is a feature of AWS Artifact.

AWS Config is used for resource inventory, configuration history, and compliance auditing against custom rules, not for providing official AWS compliance reports or downloadable PDFs like PCI DSS documentation.

AWS Trusted Advisor provides recommendations for cost optimization, performance, security, and fault tolerance, but it does not provide downloadable compliance reports or official documents like PCI DSS attestation PDFs.

IAM does not provide SSO with corporate credentials or centralized permission management across multiple AWS accounts; it is designed for user and permission management within a single account.

AWS Directory Service provides managed Microsoft Active Directory but does not offer single sign-on (SSO) to the AWS Management Console or centralized permission management across multiple accounts; it only integrates with IAM for directory-based authentication.

Amazon Cognito is designed for customer identity and access management (CIAM) for web and mobile apps, not for workforce SSO with corporate Active Directory. It does not integrate with AWS Organizations to centrally manage permissions across multiple AWS accounts.

This option requires manual effort to enable CloudTrail in each account individually and does not automatically include new accounts added in the future, violating the 'minimal ongoing manual effort' requirement.

AWS Config records resource configuration changes, not API activity. It does not capture all API calls like CloudTrail, and it cannot guarantee delivery of all API events to a centralized S3 bucket for auditing.

Amazon GuardDuty is a threat detection service that monitors for malicious activity, not a service for recording all API activity for auditing. It does not deliver a complete log of all API calls to an S3 bucket.

AWS CloudTrail records API activity but does not analyze streams for suspicious patterns or known malicious IP addresses in near-real-time; it lacks built-in threat detection and anomaly identification.

AWS Config is a service for evaluating resource configurations against desired policies, not for analyzing continuous streams of API activity or identifying malicious IP addresses. It does not provide near-real-time threat detection based on API behavior.

Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, not for analyzing real-time API activity streams to detect anomalous user behavior or known malicious IP addresses.

Security Groups operate at the instance level, not the subnet level, and use stateful rules, whereas the requirement specifies a subnet-level, stateless firewall.

AWS WAF is a web application firewall that operates at Layer 7 (application layer) and uses stateful rules to inspect HTTP/HTTPS traffic, not a network-level firewall at the subnet layer with stateless rules.

AWS Shield is a managed DDoS protection service, not a network-level firewall. It does not operate at the subnet level or provide stateless rule evaluation for inbound and outbound traffic.

Amazon Macie is designed for discovering and protecting sensitive data (e.g., PII, credentials) in S3, not for detecting network-based threats like crypto-mining traffic from EC2 instances.

AWS Config is a service for evaluating resource configurations against desired policies, not for detecting network traffic patterns or security threats like crypto-mining. It does not analyze outbound network traffic for suspicious activity.

Amazon Detective analyzes and visualizes security data to investigate the root cause of findings, but it does not automatically detect unusual outbound traffic patterns for crypto-mining without agents; it relies on data from other services like GuardDuty.

The condition 'kms:RequestTag/ConditionKey' checks for tags on the KMS API request, not on the IAM role. The requirement is to enforce that the IAM role has a specific tag, not that the request includes a tag.

The IAM role's trust policy controls who can assume the role, not what actions the role can perform. Adding a condition to deny 'kms:Decrypt' in the trust policy is ineffective because trust policies do not evaluate permissions for service actions like KMS decryption.

The S3 bucket policy cannot enforce conditions on the IAM role's tags for KMS decryption; it controls access to S3 objects, not KMS actions. The requirement is to restrict the KMS decryption permission, which is governed by IAM policies and KMS key policies, not S3 bucket policies.

Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, not for compliance checks like S3 bucket encryption settings.

AWS CloudTrail records API calls for auditing, but it does not continuously monitor resource configurations or evaluate compliance rules. It cannot detect or alert on S3 buckets lacking encryption unless you manually analyze logs.

Amazon Inspector is a vulnerability management service that scans workloads for software vulnerabilities and unintended network exposure, not for detecting S3 bucket encryption configurations.

SSE-C requires the company to manage the encryption keys themselves, including key rotation, which contradicts the requirement for a fully automated solution with no manual intervention.

AWS managed keys (aws/s3) do not support automatic annual rotation; they are rotated only when AWS deems necessary, not on a fixed yearly schedule. The compliance team's mandate for annual rotation cannot be guaranteed with this option.

AWS Network Firewall is a managed firewall for VPCs that filters traffic at the network and transport layers (Layer 3-4), not at the application layer. It cannot inspect HTTP requests for SQL injection or XSS, nor does it integrate directly with CloudFront or ALB for web ACLs.

AWS Shield Advanced provides DDoS protection but does not include pre-configured rule sets for SQL injection or XSS, nor does it offer geo-blocking capabilities. It also does not integrate directly with ALB for application-layer filtering.

AWS Firewall Manager is a policy management service that centrally configures and monitors firewall rules across accounts, but it does not itself provide the pre-configured rule sets for SQL injection or XSS protection. It manages AWS WAF rules, not the rules themselves, and does not directly integrate with CloudFront and ALB for web traffic inspection.

Amazon Inspector is designed for vulnerability management and network security assessments of EC2 instances and container workloads, not for scanning S3 objects for sensitive data like PII.

AWS Config is used for evaluating resource configurations against desired policies, not for scanning S3 objects for sensitive data like PII. It does not perform content inspection of objects.

AWS Security Hub aggregates security findings from multiple AWS services but does not perform its own data scanning for sensitive content in S3. It relies on findings from services like Amazon Macie, so it cannot directly detect PII in financial reports.

AWS Config managed rules evaluate resource configurations for compliance, but they do not record individual API calls like GetObject or PutObject, nor do they capture caller identity, source IP, or request time.

Amazon S3 server access logging provides records of requests made to a bucket, but it does not capture the identity of the caller (e.g., IAM user or role) or the source IP address in a structured format suitable for Athena analysis. It logs details like requester type (e.g., AWS account ID) but not the specific caller identity or IP address required by the question.

Amazon GuardDuty is a threat detection service that monitors for malicious activity, but it does not record detailed data events like GetObject and PutObject API calls with caller identity and source IP for auditing purposes.

AWS Security Hub provides a comprehensive view of security alerts and compliance status across AWS accounts, but it does not provide access to AWS SOC reports. The auditor specifically requested the SOC 2 Type II report, which is available through AWS Artifact.

AWS Config is used for resource inventory, configuration history, and compliance auditing of AWS resources, not for downloading compliance reports like SOC reports. The auditor's request is for a specific AWS compliance document, which is provided by AWS Artifact.

AWS Trusted Advisor provides best practice recommendations for cost optimization, performance, security, and fault tolerance, but it does not provide access to compliance reports like SOC reports. The company needs to retrieve the AWS SOC 2 Type II report, which is available through AWS Artifact, not Trusted Advisor.

ACM does not encrypt traffic between the ALB and EC2 instances; it only offloads SSL/TLS termination at the ALB. End-to-end encryption requires configuring HTTPS on the instances themselves.

ACM certificates cannot be exported for use on on-premises servers; they are tied to AWS services and cannot be downloaded or installed externally.

ACM does not require storing the private key outside AWS; in fact, ACM manages the private key securely within AWS and does not allow export of private keys for certificates used with ACM-integrated services like ALB.

AWS Shield is a managed DDoS protection service, not a vulnerability scanner. It does not perform CVE checks or assess insecure network configurations on EC2 instances.

Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, not a vulnerability scanning service that checks for CVEs and insecure configurations on EC2 instances.

AWS WAF is a web application firewall that protects web applications from common exploits, not a vulnerability scanning service for EC2 instances. It does not perform automated scans for CVEs or insecure network configurations.

IAM policies are account-specific and cannot be centrally enforced across multiple accounts in AWS Organizations. Even with full administrator permissions, users could modify or remove IAM policies within their own accounts, so IAM policies cannot prevent them from disabling CloudTrail.

Amazon CloudWatch Events can trigger actions based on CloudTrail API calls, but it cannot prevent users from disabling CloudTrail or deleting trails. It is a reactive monitoring service, not a preventive control.

IAM Access Analyzer is designed to analyze resource policies to identify resources shared with external entities, not to detect IAM users without MFA devices. It does not provide continuous compliance monitoring or reporting for MFA status.

AWS Trusted Advisor provides best-practice checks, including MFA on root account, but it does not continuously detect IAM users without MFA devices or generate custom compliance reports. It lacks the granularity to check all IAM users and cannot be configured for automated remediation or custom rules.

Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, not for IAM user MFA compliance. It cannot detect or report on IAM user MFA status.

AWS Shield Standard is a free service that provides basic DDoS protection but lacks enhanced detection, access to the DDoS Response Team (DRT), and financial protection against scaling costs, which are specifically required in the question.

AWS WAF is a web application firewall that filters and monitors HTTP/S requests, but it does not provide DDoS detection, access to the DDoS Response Team (DRT), or financial protection against scaling costs due to DDoS attacks. These features are exclusive to AWS Shield Advanced.

AWS Firewall Manager is a central security management service that helps configure and apply firewall rules across accounts and resources, but it does not provide DDoS detection, access to the DRT, or financial protection against scaling costs from DDoS attacks.

AWS Shield Advanced provides DDoS protection, not application-layer filtering for SQL injection or XSS. The question specifically requires protection against web exploits, which is the domain of AWS WAF.

Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, not a web application firewall that protects against web exploits like SQL injection and XSS.

Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, not a web application firewall that blocks common web exploits like SQL injection and XSS.

AWS Config is used to assess, audit, and evaluate configurations of AWS resources, not to provide compliance reports like SOC reports. The SOC 2 Type II report is a third-party audit report available through AWS Artifact.

AWS Trusted Advisor provides best-practice recommendations for cost optimization, performance, security, and fault tolerance, but it does not provide access to compliance reports like SOC 2 Type II. The auditor's request is for a specific report, which is available through AWS Artifact.

AWS Security Hub provides a comprehensive view of security alerts and compliance status across AWS accounts, but it does not provide access to AWS SOC reports. The auditor specifically requested the SOC 2 Type II report, which is available through AWS Artifact, not Security Hub.

Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, not a threat detection service that uses machine learning to identify suspicious API calls or anomalous behavior.

AWS Config is a service for evaluating resource configurations against desired policies, not for threat detection using machine learning or analyzing API calls for malicious activity.

AWS CloudTrail records API calls and user activity but does not use machine learning to detect threats or generate security findings; it is a logging service, not a threat detection service.

AWS Systems Manager Parameter Store does not support automatic rotation of secrets; it requires custom solutions for rotation. It also lacks fine-grained IAM policies for secret access control compared to Secrets Manager.

AWS KMS is a key management service for encryption keys, not for storing and rotating secrets like database credentials. It does not provide automatic rotation of secrets or fine-grained IAM policies for secret access.

IAM is used for managing users, groups, roles, and permissions, not for storing, managing, or rotating secrets like database credentials. It does not provide secret storage or automatic rotation capabilities.

AWS Config conformance packs evaluate resource compliance against rules but do not enforce preventive controls to block actions like disabling CloudTrail or deleting S3 logs across all accounts.

IAM permissions boundaries only restrict the maximum permissions for IAM users or roles within a single account, not across all accounts in an organization, and they do not automatically apply to future accounts.

CloudTrail data events log resource operations within AWS services (e.g., S3 object-level actions), but they do not provide any mechanism to enforce policies or prevent actions like disabling CloudTrail or deleting log files. They are a logging feature, not a governance or prevention tool.

AWS Shield Advanced provides DDoS protection, not application-layer inspection for SQL injection or XSS. It does not offer pre-configured rule sets for web attacks or integrate directly with ALB for request inspection.

Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, but it does not inspect or block incoming HTTP requests at the application layer. It cannot prevent SQL injection or XSS attacks by itself.

AWS Firewall Manager is a policy management service that centrally configures and manages firewall rules across multiple accounts and resources, but it does not itself inspect and block web traffic. It relies on AWS WAF rules to do so, and the question asks for the service that directly inspects and blocks malicious traffic, which is AWS WAF.

CloudTrail logs API activity but does not evaluate IAM user MFA status, and CloudWatch Logs alone cannot trigger email alerts based on custom compliance checks without additional services like Lambda or Config rules.

AWS Trusted Advisor can check for MFA on root accounts but not on individual IAM users, and Amazon SES is for sending emails but not integrated with Trusted Advisor for automated alerts based on IAM user MFA status.

AWS IAM Access Analyzer analyzes resource policies for external access, and Amazon Inspector assesses workload vulnerabilities; neither service monitors IAM user MFA status or sends alerts for non-compliance.

IAM alone cannot integrate with on-premises Active Directory for authentication, nor can it centrally manage permissions across multiple AWS accounts without federation or Identity Center.

AWS Directory Service for Microsoft Active Directory only provides the directory service; it does not offer the centralized permission management across multiple AWS accounts or the ability to assign AWS policies to AD groups. The company needs IAM Identity Center to integrate with AD and manage cross-account access.

AWS Resource Access Manager (RAM) is used to share resources like subnets or transit gateways across accounts, not to manage user authentication or permissions via Active Directory groups.

AWS Config is used for evaluating and auditing resource configurations, not for downloading compliance reports like SOC 2 or ISO 27001. It does not provide a centralized portal for accessing AWS compliance artifacts.

AWS Audit Manager helps continuously audit AWS usage to assess risk and compliance, but it does not provide a self-service portal to download AWS compliance reports like SOC 2 or ISO 27001. Those reports are obtained via AWS Artifact.

AWS Trusted Advisor provides recommendations for cost optimization, performance, security, and fault tolerance, but it does not provide access to compliance reports like SOC 2 or ISO 27001 certificates.

This option addresses encryption in transit (HTTPS), not encryption at rest or access control over decryption. The requirement is to restrict decryption of objects at rest to the 'Auditors' role, which is unrelated to transport encryption.

This option does not enforce that only the 'Auditors' role can decrypt objects; it only blocks public access and grants s3:GetObject, but decryption is controlled by KMS permissions, not S3 bucket policies or IAM policies for s3:GetObject.

S3 object-level logging only records access events; it does not enforce access control or prevent unauthorized decryption. The requirement is to restrict decryption access, not just monitor it.

AWS CloudHSM provides hardware-based key storage but does not offer automatic key rotation; the customer must manage rotation themselves, which violates the requirement for automatic yearly rotation.

AWS Secrets Manager is designed for managing secrets like database credentials and API keys, not for managing encryption keys for S3 data at rest. It does not provide the key rotation and access control policies needed for S3 encryption.

AWS Certificate Manager is used to manage SSL/TLS certificates for securing network traffic, not for encrypting data at rest in S3. It does not provide key rotation for S3 encryption keys.

AWS Config can detect non-compliant security group rules via managed rules, but it cannot automatically remediate them without custom AWS Config rules and custom Lambda functions, which violates the 'no custom scripting' requirement.

AWS Organizations is a service for centrally managing multiple AWS accounts, but it does not provide security group rule enforcement or remediation. It lacks the ability to automatically detect and fix non-compliant security groups.

AWS Shield Advanced is a managed DDoS protection service, not a service for centrally enforcing security group rules across accounts. It does not provide security group compliance or remediation capabilities.

AWS Config records resource configuration changes and evaluates compliance, but it does not capture management events like API calls (e.g., creating EC2 instances). The question specifically requires recording management events, which is CloudTrail's function.

Amazon CloudWatch Logs is used for monitoring, storing, and accessing log files from AWS resources, but it does not record management events like API calls across accounts. The requirement to capture management events across all accounts and deliver to a centralized S3 bucket is specifically a CloudTrail feature.

AWS Audit Manager helps audit AWS usage by continuously evaluating controls, but it does not natively record and centralize management events like CloudTrail. It relies on CloudTrail logs for evidence, not as the primary event recorder.

AWS CloudHSM provides hardware security modules (HSMs) but does not offer automatic key rotation; it requires manual rotation or custom scripting, increasing operational overhead. The question specifies automatic rotation every 365 days, which is a built-in feature of AWS KMS, not CloudHSM.

AWS Certificate Manager (ACM) is used to provision, manage, and deploy public and private SSL/TLS certificates, not for managing encryption keys for EBS volumes. It does not provide customer-managed keys or automatic rotation for EBS encryption.

AWS Secrets Manager is designed for managing secrets like database credentials and API keys, not for managing encryption keys for EBS volumes. It does not provide the key management or automatic rotation for customer-managed encryption keys used with EBS encryption.

Amazon GuardDuty is a threat detection service that monitors for malicious activity, not a compliance enforcement tool. It cannot automatically detect or remediate S3 bucket encryption configurations.

AWS CloudTrail records API activity but cannot automatically remediate non-compliant S3 bucket encryption; it lacks the enforcement and auto-remediation capabilities required for this use case.

AWS Trusted Advisor provides best-practice recommendations but does not automatically enforce or remediate non-compliant resources. It cannot automatically apply encryption configuration to S3 buckets.

AWS CloudTrail records API activity and provides audit logs, but it does not continuously evaluate resource configurations against compliance rules or automatically flag non-compliant resources like publicly accessible RDS instances.

AWS Trusted Advisor provides best-practice checks and recommendations, but it does not continuously monitor resource configurations or trigger alerts for compliance violations like public RDS instances. It lacks the ability to define custom rules and automatically flag non-compliant resources in real time.

Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, not for compliance configuration rules like RDS public accessibility. It does not evaluate resource configurations against compliance rules.

Amazon GuardDuty is a threat detection service that monitors for malicious activity, not a compliance enforcement tool. It cannot automatically remediate S3 bucket public access settings.

AWS CloudTrail records API activity but does not continuously evaluate resource compliance or automatically remediate misconfigurations. It lacks built-in rules for S3 public access and cannot apply fixes.

IAM is used for managing user permissions and access control, not for continuous compliance monitoring or automatic remediation of S3 bucket configurations.

AWS CloudTrail records API activity but does not continuously evaluate resource configurations like MFA status or trigger notifications for non-compliant users.

Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, not for verifying IAM user MFA status or sending notifications about new users without MFA.

AWS Trusted Advisor provides best-practice checks, including MFA on root account, but it does not automatically verify MFA for all IAM users or trigger notifications when a new user is created without MFA. It lacks the continuous compliance monitoring and custom rule enforcement needed for this requirement.

Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, not for evaluating resource configurations against internal security policies like encryption or public access settings.

AWS Trusted Advisor provides best-practice checks and recommendations, but it does not continuously monitor resource configurations against custom internal policies or provide a compliance dashboard over time; it focuses on AWS-recommended best practices, not user-defined rules.

AWS CloudTrail records API activity for auditing, but it does not evaluate resource configurations against rules or provide a compliance dashboard for resource settings like encryption or public access.

AWS Trusted Advisor provides best-practice checks, including S3 bucket permissions, but it does not allow you to define custom rules or evaluate compliance continuously across all accounts from a single dashboard. It also does not integrate with AWS Organizations to aggregate compliance status.

Amazon Inspector is designed for vulnerability management and network security assessments of EC2 instances and container workloads, not for evaluating S3 bucket policies or compliance across multiple accounts.

AWS Shield is a managed DDoS protection service, not a configuration compliance or auditing tool. It does not check S3 bucket policies for public access or provide a compliance dashboard across multiple accounts.

Under the AWS Shared Responsibility Model, AWS is responsible for applying minor version patches to the RDS database engine. The customer only controls patching for the EC2 instance or self-managed databases.

Under the AWS Shared Responsibility Model, AWS manages the physical security of data centers, including where RDS instances are hosted. The customer is not responsible for data center physical security.

Under the AWS Shared Responsibility Model, AWS is responsible for the physical infrastructure, including replacing failed hardware components in the RDS host server. The customer does not manage hardware replacements.