CLF-C02 Cloud Concepts Practice Question
A company is migrating a three-tier web application to AWS. The application will run on Amazon EC2 instances using a custom Linux distribution, and a self-managed MySQL database will be installed on the same instances. The company's security team needs to understand which security responsibilities belong to AWS and which belong to the company under the AWS Shared Responsibility Model. According to this model, who is responsible for applying operating system security patches to the EC2 instances and for updating the MySQL database software?
⚠ Common exam trap
Many exam-takers confuse self-managed software on EC2 with AWS-managed services (like RDS) and incorrectly assume AWS handles patching for any database or OS running on EC2.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The company is responsible for both the operating system patches and the MySQL database updates.
Under the AWS Shared Responsibility Model, AWS is responsible for the security of the cloud (e.g., physical infrastructure, hypervisor), while the customer is responsible for security in the cloud (e.g., guest OS, applications, and data). Since the company is using a custom Linux distribution on EC2 instances and installing a self-managed MySQL database, both the operating system patches and the MySQL database updates fall under the customer's responsibility. AWS does not manage or patch the guest operating system or any software installed by the customer on EC2 instances.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS is responsible for both the operating system patches and the MySQL database updates.
Why it's wrong here
Under the shared responsibility model, AWS is responsible for the security of the cloud, which includes physical data centers, networking, and the hypervisor layer, not for OS-level patches or software like MySQL. The company's obligation covers the EC2 guest OS, the installed applications, and the MySQL database, so AWS is not responsible for either component. This option completely misassigns both responsibilities, so it is incorrect.
When this WOULD be correct
This option would be correct if the question specified that the company is using an AWS-managed service, such as Amazon RDS for MySQL and Amazon EC2 with an AWS-managed OS (e.g., Amazon Linux with automatic patching enabled). In that case, AWS handles both OS and database software updates.
- ✓
The company is responsible for both the operating system patches and the MySQL database updates.
Why this is correct
The company operates the EC2 instance, so under the shared responsibility model (AWS Shared Responsibility Model), the customer retains complete control over the guest operating system, including installing patches and updates. Because the MySQL database is installed and configured on that EC2 instance rather than using a managed service like Amazon RDS, the company is also fully responsible for MySQL version updates, security patches, and configuration maintenance. Neither OS patching nor MySQL updates fall under AWS's responsibility, as AWS only manages the physical hardware, hypervisor, and network infrastructure.
- ✗
AWS is responsible for the operating system patches, and the company is responsible for the MySQL database updates.
Why it's wrong here
AWS never patches the guest operating system of an EC2 instance; that is a customer responsibility because the customer has admin access to the OS. AWS does maintain the underlying hypervisor and physical host, but these are invisible to the instance and not managed through the guest OS. While assigning MySQL updates to the company is correct in this scenario, the claim about AWS handling OS patches violates the shared responsibility model, making this answer incorrect.
- ✗
The company is responsible for the operating system patches, and AWS is responsible for the MySQL database updates.
Why it's wrong here
The company does indeed need to patch the operating system on its EC2 instance, but AWS does not update MySQL databases that run on that instance. If the MySQL database were deployed on Amazon RDS, then AWS would handle database patching and minor upgrades, but since it's part of the application on an EC2 instance, the company has full responsibility. Therefore, this option incorrectly offloads MySQL update duties to AWS, which is not how the shared responsibility model works for self-managed databases.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓The company is responsible for both the operating system patches and the MySQL database updates.Correct answer▾
Why this is correct
The company operates the EC2 instance, so under the shared responsibility model (AWS Shared Responsibility Model), the customer retains complete control over the guest operating system, including installing patches and updates. Because the MySQL database is installed and configured on that EC2 instance rather than using a managed service like Amazon RDS, the company is also fully responsible for MySQL version updates, security patches, and configuration maintenance. Neither OS patching nor MySQL updates fall under AWS's responsibility, as AWS only manages the physical hardware, hypervisor, and network infrastructure.
✗AWS is responsible for both the operating system patches and the MySQL database updates.Wrong answer — click to see why▾
Why this is wrong here
Under the AWS Shared Responsibility Model, AWS is responsible for the security of the cloud (e.g., physical infrastructure), but the customer is responsible for security in the cloud, including patching the guest OS and any applications like MySQL. Since the company uses a custom Linux distribution and self-manages MySQL on EC2, both patching responsibilities fall on the company.
★ When this WOULD be the correct answer
This option would be correct if the question specified that the company is using an AWS-managed service, such as Amazon RDS for MySQL and Amazon EC2 with an AWS-managed OS (e.g., Amazon Linux with automatic patching enabled). In that case, AWS handles both OS and database software updates.
Why candidates choose this
Candidates may mistakenly believe that AWS handles all security patches for EC2 instances, confusing infrastructure-level security with guest OS and application-level security. They might also think that because MySQL is a database, it falls under AWS's responsibility, not realizing that self-managed software is the customer's responsibility.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.