CLF-C02 Cloud Concepts Practice Question
A company is migrating its on-premises applications to the AWS Cloud. The Chief Security Officer wants to confirm the division of security responsibilities. According to the AWS Shared Responsibility Model, which of the following tasks is the customer's responsibility?
⚠ Common exam trap
Many candidates confuse the customer's responsibility for managing network ACLs with AWS's responsibility for managing the underlying network infrastructure, such as the hypervisor or physical hardware, leading them to incorrectly select options A, B, or D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Managing network access control lists (ACLs) for the customer's VPC
Managing network access control lists (ACLs) for a customer's VPC is explicitly a customer responsibility under the AWS Shared Responsibility Model. Customers control inbound and outbound traffic at the subnet level by configuring NACLs, which are stateless firewall rules. AWS provides the infrastructure and the VPC service, but the customer must define and manage the ACL rules to enforce network segmentation and security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ensuring the physical security of AWS data centers
Why it's wrong here
Ensuring the physical security of AWS data centers is wholly AWS's responsibility under the shared responsibility model. This includes perimeter fencing, biometric access controls, 24/7 security personnel, video surveillance, and environmental systems. A customer migrating on-premises applications has no visibility into or control over these physical controls, so this task cannot be performed by the customer. Even if the customer previously managed physical security for its own data center, AWS handles all physical security once workloads run in the cloud.
When this WOULD be correct
If the question asked about a customer's responsibility in a hybrid environment where the customer manages their own on-premises data center, then ensuring physical security of that facility would be the customer's responsibility.
- ✗
Patching the hypervisor layer that runs Amazon EC2 instances
Why it's wrong here
The hypervisor layer that runs Amazon EC2 instances is fully managed and patched by AWS because the hypervisor is part of the virtualization infrastructure that AWS controls. Customers are only responsible for patching the guest operating system and applications inside their instances, such as applying updates to Linux or Windows within the guest OS. AWS applies hypervisor security updates and often live-migrates running instances to avoid downtime during maintenance. Therefore, a customer migrating from on-premises virtualization environments must adapt to this division of responsibility but never patches AWS's hypervisor.
When this WOULD be correct
A question that asks about customer responsibility for patching the operating system or applications running on an EC2 instance, or for managing security groups and network ACLs, would make this option correct.
- ✓
Managing network access control lists (ACLs) for the customer's VPC
Why this is correct
Network ACLs are stateless firewall rules that control inbound and outbound traffic at the subnet level within a VPC. Configuring and managing these rules is the customer's responsibility as part of managing security in the cloud.
- ✗
Replacing defective hardware components in the AWS global infrastructure
Why it's wrong here
Replacing defective hardware components in the AWS global infrastructure is a maintenance task owned entirely by AWS as part of the 'security of the cloud.' This spans failed hard drives, faulty network switches, and degraded memory modules inside AWS data centers. Customers never touch or manage the underlying hardware; they interact only with virtualized resources such as Amazon EC2 instances, which AWS automatically migrates off failing hosts. Thus, although a customer may have replaced server hardware on premises, that responsibility does not transfer to the cloud.
When this WOULD be correct
If the question asked about responsibilities in an on-premises data center or a hybrid model where the customer manages physical hardware, then replacing defective hardware would be the customer's task.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓Managing network access control lists (ACLs) for the customer's VPCCorrect answer▾
Why this is correct
Network ACLs are stateless firewall rules that control inbound and outbound traffic at the subnet level within a VPC. Configuring and managing these rules is the customer's responsibility as part of managing security in the cloud.
✗Ensuring the physical security of AWS data centersWrong answer — click to see why▾
Why this is wrong here
Physical security of AWS data centers is the responsibility of AWS under the Shared Responsibility Model, not the customer.
★ When this WOULD be the correct answer
If the question asked about a customer's responsibility in a hybrid environment where the customer manages their own on-premises data center, then ensuring physical security of that facility would be the customer's responsibility.
Why candidates choose this
Candidates may confuse the division of responsibilities, thinking that all security aspects, including physical, fall under the customer's purview, especially when the question emphasizes security concerns.
✗Patching the hypervisor layer that runs Amazon EC2 instancesWrong answer — click to see why▾
Why this is wrong here
Patching the hypervisor is the responsibility of AWS under the Shared Responsibility Model, as it is part of the underlying infrastructure that AWS manages. The customer is responsible for patching the guest OS and applications on EC2 instances.
★ When this WOULD be the correct answer
A question that asks about customer responsibility for patching the operating system or applications running on an EC2 instance, or for managing security groups and network ACLs, would make this option correct.
Why candidates choose this
Candidates may confuse hypervisor patching with OS patching, or assume that since they manage the EC2 instance, they also manage the hypervisor, not realizing the hypervisor is part of AWS's managed infrastructure.
✗Replacing defective hardware components in the AWS global infrastructureWrong answer — click to see why▾
Why this is wrong here
Replacing defective hardware in AWS global infrastructure is the responsibility of AWS, not the customer, under the Shared Responsibility Model.
★ When this WOULD be the correct answer
If the question asked about responsibilities in an on-premises data center or a hybrid model where the customer manages physical hardware, then replacing defective hardware would be the customer's task.
Why candidates choose this
Candidates may confuse hardware maintenance with general IT responsibilities, not realizing that AWS handles physical infrastructure in the cloud.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.