CLF-C02 Cloud Concepts Practice Question
A startup is migrating a web application to AWS. The application runs on Amazon EC2 instances that use a custom Amazon Machine Image (AMI) with the company's proprietary software. The security team needs to understand which security tasks the company must perform. Under the AWS Shared Responsibility Model, which of the following is the customer's responsibility?
⚠ Common exam trap
Test-takers frequently confuse 'patching the hypervisor' (AWS responsibility) with 'patching the guest OS' (customer responsibility), leading them to incorrectly select Option A as a customer task.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configuring security groups to control inbound traffic to the instances
Configuring security groups is a customer responsibility because security groups act as a virtual firewall for EC2 instances, controlling inbound and outbound traffic at the instance level. Under the AWS Shared Responsibility Model, the customer is responsible for configuring network access controls, while AWS manages the underlying infrastructure. This includes defining rules based on IP protocols, ports, and source/destination CIDR ranges.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Patching the hypervisor that hosts the EC2 instances
Why it's wrong here
The hypervisor is the virtualization layer that runs on AWS-managed host hardware and isolates EC2 instances from one another. Because a hypervisor vulnerability could affect multiple tenants, AWS controls and patches it along with the underlying host operating system. Customers only receive a logical instance and are responsible for patching the guest operating system and installed applications, not the hypervisor or host hardware.
When this WOULD be correct
If the question asked about patching the guest operating system or applications running on the EC2 instance, then the customer would be responsible for that task.
- ✓
Configuring security groups to control inbound traffic to the instances
Why this is correct
Security groups are stateful, instance-level virtual firewalls that customers fully configure. Defining inbound rules to allow or deny traffic by source IP, port, and protocol is a customer responsibility under the AWS Shared Responsibility Model. AWS provides the enforcement mechanism, but the rules themselves are customer-defined, making this a required customer task.
- ✗
Physical security of the data center where the instances run
Why it's wrong here
AWS data centers are protected by multiple layers of physical security, including perimeter fencing, 24/7 security guards, biometric access controls, and video surveillance. These controls are independently audited under compliance programs like SOC, ISO, and PCI, and customers are never granted physical access to server rooms. Therefore, maintaining physical security and data center access is exclusively AWS's responsibility, not the application owner's.
When this WOULD be correct
If the question asked about a customer's responsibility in an on-premises data center or a hybrid scenario where the customer manages their own physical infrastructure, then physical security would be the customer's responsibility.
- ✗
Maintaining the underlying network infrastructure
Why it's wrong here
The physical and logical network infrastructure that carries traffic inside AWS, such as data center switches, routers, and cabling, is operated and maintained entirely by AWS. Customers never access or manage these devices, and AWS isolates VPC traffic over this managed hardware. While customers configure virtual network constructs like VPCs and subnets, they cannot patch or maintain the underlying network devices, so this is not a customer responsibility.
When this WOULD be correct
If the question asked about a hybrid deployment where the customer manages their own on-premises network that connects to AWS (e.g., via Direct Connect or VPN), then maintaining that customer-side network infrastructure would be the customer's responsibility.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓Configuring security groups to control inbound traffic to the instancesCorrect answer▾
Why this is correct
Security groups are stateful, instance-level virtual firewalls that customers fully configure. Defining inbound rules to allow or deny traffic by source IP, port, and protocol is a customer responsibility under the AWS Shared Responsibility Model. AWS provides the enforcement mechanism, but the rules themselves are customer-defined, making this a required customer task.
✗Patching the hypervisor that hosts the EC2 instancesWrong answer — click to see why▾
Why this is wrong here
Patching the hypervisor is AWS's responsibility under the Shared Responsibility Model, as it is part of the virtualization layer managed by AWS.
★ When this WOULD be the correct answer
If the question asked about patching the guest operating system or applications running on the EC2 instance, then the customer would be responsible for that task.
Why candidates choose this
Candidates may confuse hypervisor patching with OS patching, assuming all patching is the customer's responsibility, or they may not fully understand the division of security responsibilities in the cloud.
✗Physical security of the data center where the instances runWrong answer — click to see why▾
Why this is wrong here
Physical security of the data center is AWS's responsibility under the Shared Responsibility Model, not the customer's. The customer is responsible for security in the cloud, not of the cloud.
★ When this WOULD be the correct answer
If the question asked about a customer's responsibility in an on-premises data center or a hybrid scenario where the customer manages their own physical infrastructure, then physical security would be the customer's responsibility.
Why candidates choose this
Candidates may confuse the shared responsibility model, thinking that physical security is a shared task, or they may not clearly distinguish between security of the cloud (AWS) and security in the cloud (customer).
✗Maintaining the underlying network infrastructureWrong answer — click to see why▾
Why this is wrong here
Maintaining the underlying network infrastructure is AWS's responsibility under the Shared Responsibility Model, not the customer's. The customer is responsible for configuring network controls like security groups and VPC settings, but not the physical or logical network infrastructure itself.
★ When this WOULD be the correct answer
If the question asked about a hybrid deployment where the customer manages their own on-premises network that connects to AWS (e.g., via Direct Connect or VPN), then maintaining that customer-side network infrastructure would be the customer's responsibility.
Why candidates choose this
Candidates may confuse 'network infrastructure' with customer-managed network configurations (e.g., VPC, subnets, routing) and think it includes underlying hardware or AWS-managed components.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.