How should I use these Shared Responsibility Model practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Shared Responsibility Model questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Shared Responsibility Model domain.

CLF-C02 · topic practice

Shared Responsibility Model practice questions

Practise AWS Certified Cloud Practitioner CLF-C02 Shared Responsibility Model practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

11 questionsDomain: Shared Responsibility Model

Practice 10 questions Browse domain →

What the exam tests

What to know about Shared Responsibility Model

Shared Responsibility Model questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Shared Responsibility Model exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Shared Responsibility Model questions

11 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full NAT/PAT explanation →

A company uses Amazon RDS to run their production database. Under the AWS Shared Responsibility Model, who is responsible for patching the underlying database engine software?

Trap 1: The customer, because they chose to run a relational database

For EC2-based databases, the customer patches the OS and database software. For managed RDS, the model is different — AWS handles engine patching.

Trap 2: A shared responsibility where AWS and the customer each patch…

For RDS engine patching specifically, it is AWS's responsibility. While some configuration decisions belong to the customer, engine patching is managed by AWS.

Trap 3: A third-party DBA contracted by the customer

The Shared Responsibility Model is between AWS and the customer. Third parties contracted by the customer are still considered the customer's responsibility in this model.

Study all Shared Responsibility Model common traps →

A
The customer, because they chose to run a relational database
Why wrong: For EC2-based databases, the customer patches the OS and database software. For managed RDS, the model is different — AWS handles engine patching.
B
AWS, because RDS is a managed service that abstracts OS and engine management
RDS is a managed database service. AWS is responsible for patching the database engine (MySQL, PostgreSQL, etc.), the underlying OS, and the hardware. This is why RDS sits on the 'AWS manages' side for engine patching, unlike a self-managed DB on EC2.
C
A shared responsibility where AWS and the customer each patch different components
Why wrong: For RDS engine patching specifically, it is AWS's responsibility. While some configuration decisions belong to the customer, engine patching is managed by AWS.
D
A third-party DBA contracted by the customer
Why wrong: The Shared Responsibility Model is between AWS and the customer. Third parties contracted by the customer are still considered the customer's responsibility in this model.

Full breakdown with real-world context →

Question 2mediummultiple choice

Read the full Shared Responsibility Model explanation →

A company is migrating its on-premises applications to the AWS Cloud. The Chief Security Officer wants to confirm the division of security responsibilities. According to the AWS Shared Responsibility Model, which of the following tasks is the customer's responsibility?

Trap 1: Ensuring the physical security of AWS data centers

Physical security of data centers is the responsibility of AWS. This includes controlled access, surveillance, and environmental controls. Customers do not have physical access to data centers and do not manage physical security.

Trap 2: Patching the hypervisor layer that runs Amazon EC2 instances

The hypervisor, which abstracts the underlying hardware for Amazon EC2 instances, is managed and patched by AWS. Customers are responsible only for patching the guest operating system and applications running on their instances.

Trap 3: Replacing defective hardware components in the AWS global…

AWS is responsible for the maintenance and replacement of all hardware components in its data centers, including servers, storage devices, and networking equipment. Customers do not perform hardware replacements.

Study all Shared Responsibility Model common traps →

A
Ensuring the physical security of AWS data centers
Why wrong: Physical security of data centers is the responsibility of AWS. This includes controlled access, surveillance, and environmental controls. Customers do not have physical access to data centers and do not manage physical security.
B
Patching the hypervisor layer that runs Amazon EC2 instances
Why wrong: The hypervisor, which abstracts the underlying hardware for Amazon EC2 instances, is managed and patched by AWS. Customers are responsible only for patching the guest operating system and applications running on their instances.
C
Managing network access control lists (ACLs) for the customer's VPC
Network ACLs are stateless firewall rules that control inbound and outbound traffic at the subnet level within a VPC. Configuring and managing these rules is the customer's responsibility as part of managing security in the cloud.
D
Replacing defective hardware components in the AWS global infrastructure
Why wrong: AWS is responsible for the maintenance and replacement of all hardware components in its data centers, including servers, storage devices, and networking equipment. Customers do not perform hardware replacements.

Full breakdown with real-world context →

Question 3mediummultiple choice

Read the full Shared Responsibility Model explanation →

A company is migrating an on-premises application to AWS. The application will run on Amazon EC2 instances and use an Amazon RDS for MySQL database. The security team needs to understand which security controls remain the company's responsibility after the migration. Under the AWS Shared Responsibility Model, which of the following is the customer's responsibility?

Trap 1: Patching the MySQL database engine for the Amazon RDS instance.

Incorrect. Amazon RDS is a managed service; AWS is responsible for patching the database engine. The customer only manages data and access.

Trap 2: Providing physical security at the AWS data center facilities.

Incorrect. Physical security of AWS data centers is entirely the responsibility of AWS. Customers do not have physical access to data centers.

Trap 3: Replacing failed network switches in the AWS global network.

Incorrect. AWS manages and replaces all physical network hardware as part of its responsibility for the security of the cloud.

Study all Shared Responsibility Model common traps →

A
Patching the MySQL database engine for the Amazon RDS instance.
Why wrong: Incorrect. Amazon RDS is a managed service; AWS is responsible for patching the database engine. The customer only manages data and access.
B
Patching the guest operating system on the Amazon EC2 instances.
Correct. The customer is responsible for the security of the guest OS on EC2 instances, including applying patches and updates. AWS manages the hypervisor and physical infrastructure.
C
Providing physical security at the AWS data center facilities.
Why wrong: Incorrect. Physical security of AWS data centers is entirely the responsibility of AWS. Customers do not have physical access to data centers.
D
Replacing failed network switches in the AWS global network.
Why wrong: Incorrect. AWS manages and replaces all physical network hardware as part of its responsibility for the security of the cloud.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full Shared Responsibility Model explanation →

According to the AWS Shared Responsibility Model, which of the following is AWS responsible for?

Trap 1: Encrypting customer data stored in Amazon S3

While AWS provides encryption tools, the customer is responsible for choosing to enable encryption and managing customer-managed keys.

Trap 2: Configuring security groups for EC2 instances

Security group configuration is the customer's responsibility — it's part of securing the network within the cloud.

Trap 3: Managing IAM user access policies

IAM policy management is entirely the customer's responsibility; AWS provides the IAM service but doesn't configure customer policies.

Study all Shared Responsibility Model common traps →

A
Encrypting customer data stored in Amazon S3
Why wrong: While AWS provides encryption tools, the customer is responsible for choosing to enable encryption and managing customer-managed keys.
B
Configuring security groups for EC2 instances
Why wrong: Security group configuration is the customer's responsibility — it's part of securing the network within the cloud.
C
Physical security of data center facilities
AWS is fully responsible for the physical security of its data centers — customers have no access or control over this layer.
D
Managing IAM user access policies
Why wrong: IAM policy management is entirely the customer's responsibility; AWS provides the IAM service but doesn't configure customer policies.

Full breakdown with real-world context →

Question 5easymultiple choice

Read the full Shared Responsibility Model explanation →

Under the AWS Shared Responsibility Model, which of the following is the customer's responsibility when using Amazon RDS?

Trap 1: Patching the underlying EC2 instances hosting the database

AWS patches the underlying EC2 instances for RDS — this is part of the managed service responsibility that AWS assumes.

Trap 2: Managing the physical storage media and hardware

AWS manages all physical infrastructure including storage hardware — customers have no access or responsibility for physical components.

Trap 3: Applying database engine minor version patches

AWS applies database engine patches during maintenance windows in managed RDS — customers only need to approve maintenance windows.

Study all Shared Responsibility Model common traps →

A
Patching the underlying EC2 instances hosting the database
Why wrong: AWS patches the underlying EC2 instances for RDS — this is part of the managed service responsibility that AWS assumes.
B
Managing the physical storage media and hardware
Why wrong: AWS manages all physical infrastructure including storage hardware — customers have no access or responsibility for physical components.
C
Managing database user accounts and controlling data access
Customers are responsible for their data, creating database users, setting permissions, and controlling which applications and users can access the database.
D
Applying database engine minor version patches
Why wrong: AWS applies database engine patches during maintenance windows in managed RDS — customers only need to approve maintenance windows.

Full breakdown with real-world context →

Question 6mediummultiple choice

Read the full Shared Responsibility Model explanation →

According to the AWS Shared Responsibility Model, which of the following is the customer's responsibility when using AWS Lambda?

Trap 1: Patching the Lambda execution environment and runtime

AWS manages the Lambda execution environment, including runtime updates and security patches — this is AWS's responsibility for serverless services.

Trap 2: Managing the underlying servers that run Lambda functions

AWS manages all underlying infrastructure for Lambda — customers have no access to the servers running their functions.

Trap 3: Ensuring Lambda scales automatically during traffic spikes

Lambda's automatic scaling is an AWS-managed capability — customers don't configure or manage scaling infrastructure for Lambda.

Study all Shared Responsibility Model common traps →

A
Patching the Lambda execution environment and runtime
Why wrong: AWS manages the Lambda execution environment, including runtime updates and security patches — this is AWS's responsibility for serverless services.
B
Managing the underlying servers that run Lambda functions
Why wrong: AWS manages all underlying infrastructure for Lambda — customers have no access to the servers running their functions.
C
Writing secure function code and managing IAM permissions for the function
Customers are responsible for their function's code quality and security, the IAM role permissions granted to the function, and the security of data processed by the function.
D
Ensuring Lambda scales automatically during traffic spikes
Why wrong: Lambda's automatic scaling is an AWS-managed capability — customers don't configure or manage scaling infrastructure for Lambda.

Full breakdown with real-world context →

Question 7easymultiple choice

Read the full Shared Responsibility Model explanation →

According to the AWS Shared Responsibility Model, for which of the following is the customer ALWAYS responsible, regardless of the AWS service used?

Trap 1: Physical security of the data center

Physical security is always AWS's responsibility — customers have no physical access to AWS data centers.

Trap 2: Patching the underlying hypervisor

Hypervisor patching is AWS's responsibility for all compute services — customers never have access to or responsibility for the virtualization layer.

Trap 3: Network infrastructure management

Physical network infrastructure is AWS's responsibility — customers manage virtual network configuration (VPCs, subnets, security groups) but not the underlying physical network.

Study all Shared Responsibility Model common traps →

A
Physical security of the data center
Why wrong: Physical security is always AWS's responsibility — customers have no physical access to AWS data centers.
B
Patching the underlying hypervisor
Why wrong: Hypervisor patching is AWS's responsibility for all compute services — customers never have access to or responsibility for the virtualization layer.
C
Customer data and its classification
Customer data ownership and responsibility never transfers to AWS — the customer always decides what data to store, how to classify it, who can access it, and whether to encrypt it.
D
Network infrastructure management
Why wrong: Physical network infrastructure is AWS's responsibility — customers manage virtual network configuration (VPCs, subnets, security groups) but not the underlying physical network.

Full breakdown with real-world context →

Question 8easymultiple choice

Read the full Shared Responsibility Model explanation →

Under the AWS Shared Responsibility Model, which scenario correctly demonstrates the customer's responsibility?

Trap 1: AWS ensuring the physical data center is protected from…

Physical data center security is AWS's responsibility — customers have no physical access to AWS facilities.

Trap 2: AWS patching the underlying hypervisor on EC2 hosts

Hypervisor patching is AWS's responsibility — customers don't have access to the hypervisor layer.

Trap 3: AWS ensuring S3 storage hardware is replaced when it fails

Hardware maintenance and replacement is AWS's responsibility — S3's 11-nine durability is achieved through AWS's hardware management.

Study all Shared Responsibility Model common traps →

A
AWS ensuring the physical data center is protected from unauthorized entry
Why wrong: Physical data center security is AWS's responsibility — customers have no physical access to AWS facilities.
B
A customer configuring security groups to restrict unnecessary inbound traffic to EC2 instances
Security group configuration is the customer's responsibility — AWS provides the security group mechanism, but configuring appropriate rules is the customer's job.
C
AWS patching the underlying hypervisor on EC2 hosts
Why wrong: Hypervisor patching is AWS's responsibility — customers don't have access to the hypervisor layer.
D
AWS ensuring S3 storage hardware is replaced when it fails
Why wrong: Hardware maintenance and replacement is AWS's responsibility — S3's 11-nine durability is achieved through AWS's hardware management.

Full breakdown with real-world context →

Question 9mediummultiple choice

Read the full Shared Responsibility Model explanation →

An organization needs to sign a Business Associate Agreement (BAA) with AWS to run applications that process Protected Health Information (PHI) under HIPAA. Which statement about AWS and HIPAA is accurate?

Trap 1: AWS is HIPAA certified, meaning all AWS services automatically…

HIPAA is a legal framework without a formal certification — AWS is HIPAA-eligible for specific services. Not all services are HIPAA-eligible and customers must configure appropriate controls.

Trap 2: PHI cannot be stored in the cloud because cloud environments are…

PHI can legally be stored and processed in AWS cloud environments using HIPAA-eligible services with a signed BAA and appropriate security configurations.

Trap 3: HIPAA compliance is automatic once a BAA is signed with AWS

Signing a BAA is necessary but not sufficient for HIPAA compliance — customers must also implement appropriate technical safeguards (encryption, access controls, audit logging) within their environment.

Study all Shared Responsibility Model common traps →

A
AWS is HIPAA certified, meaning all AWS services automatically comply with HIPAA
Why wrong: HIPAA is a legal framework without a formal certification — AWS is HIPAA-eligible for specific services. Not all services are HIPAA-eligible and customers must configure appropriate controls.
B
AWS will sign a BAA for eligible services, and customers are responsible for configuring services to meet HIPAA requirements
AWS signs BAAs for HIPAA-eligible services. The Shared Responsibility Model applies — AWS secures the infrastructure, customers must configure encryption, access controls, and audit logging per HIPAA requirements.
C
PHI cannot be stored in the cloud because cloud environments are inherently non-compliant with HIPAA
Why wrong: PHI can legally be stored and processed in AWS cloud environments using HIPAA-eligible services with a signed BAA and appropriate security configurations.
D
HIPAA compliance is automatic once a BAA is signed with AWS
Why wrong: Signing a BAA is necessary but not sufficient for HIPAA compliance — customers must also implement appropriate technical safeguards (encryption, access controls, audit logging) within their environment.

Full breakdown with real-world context →

Question 10easymultiple choice

Read the full NAT/PAT explanation →

A company runs a web application on Amazon EC2 instances. Under the AWS Shared Responsibility Model, who is responsible for patching the operating system on the EC2 instances?

Trap 1: AWS, because they own and operate all EC2 infrastructure

AWS is responsible for the underlying hardware, hypervisor, and physical security of EC2. However, once an EC2 instance is launched, the guest operating system is the customer's responsibility.

Trap 2: Both AWS and the customer equally share this responsibility

Responsibility is not equally shared — the dividing line is clear. AWS owns the hypervisor and below; the customer owns the guest OS and above. OS patching is entirely the customer's responsibility.

Trap 3: A third-party managed service provider designated by AWS

AWS does not designate third parties for OS patching. The responsibility falls clearly on the customer unless they use a managed service like RDS that abstracts OS management.

Study all Shared Responsibility Model common traps →

A
AWS, because they own and operate all EC2 infrastructure
Why wrong: AWS is responsible for the underlying hardware, hypervisor, and physical security of EC2. However, once an EC2 instance is launched, the guest operating system is the customer's responsibility.
B
The customer, because OS patching is in the customer's area of responsibility for IaaS services
For EC2 (IaaS), the customer is responsible for the guest OS including patching, security configuration, and updates. AWS manages the hypervisor and physical infrastructure below the OS.
C
Both AWS and the customer equally share this responsibility
Why wrong: Responsibility is not equally shared — the dividing line is clear. AWS owns the hypervisor and below; the customer owns the guest OS and above. OS patching is entirely the customer's responsibility.
D
A third-party managed service provider designated by AWS
Why wrong: AWS does not designate third parties for OS patching. The responsibility falls clearly on the customer unless they use a managed service like RDS that abstracts OS management.

Full breakdown with real-world context →

Question 11easymultiple choice

Read the full Shared Responsibility Model explanation →

Under the AWS Shared Responsibility Model, what is AWS responsible for when a customer uses AWS Lambda?

Trap 1: Writing the Lambda function code

Function code is always the customer's responsibility — AWS doesn't write customer application logic.

Trap 2: Configuring IAM roles and permissions for Lambda functions

IAM role configuration for Lambda functions is the customer's responsibility — which AWS services the function can call and what data it can access.

Trap 3: Encrypting the data processed by the function

Data encryption choices and key management for data processed by Lambda is the customer's responsibility within their function and data stores.

Study all Shared Responsibility Model common traps →

A
Writing the Lambda function code
Why wrong: Function code is always the customer's responsibility — AWS doesn't write customer application logic.
B
Managing the underlying OS, runtime, and execution environment
For Lambda, AWS manages the entire infrastructure stack including OS, runtime patching, scaling infrastructure, and execution environment — customers only manage their function code.
C
Configuring IAM roles and permissions for Lambda functions
Why wrong: IAM role configuration for Lambda functions is the customer's responsibility — which AWS services the function can call and what data it can access.
D
Encrypting the data processed by the function
Why wrong: Data encryption choices and key management for data processed by Lambda is the customer's responsibility within their function and data stores.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Shared Responsibility Model sessions

Start a Shared Responsibility Model only practice session

Every question in these sessions is drawn from the Shared Responsibility Model domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Shared Responsibility Model questions →Mixed CLF-C02 session

Frequently asked questions

What does the CLF-C02 exam test about Shared Responsibility Model?: Shared Responsibility Model questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Shared Responsibility Model questions in a focused session?: Yes — the session launcher on this page draws every question from the Shared Responsibility Model domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other CLF-C02 topics?: Use the topic links above to move to related areas, or go back to the CLF-C02 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the CLF-C02 exam covers. They are not copied from any real exam or dump site.

Shared Responsibility Model only

10 questions 20 questions 30 questions 50 questions

Mixed CLF-C02 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All CLF-C02 questions Shared Responsibility Model domain overview CLF-C02 exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Shared Responsibility Model practice questions

What to know about Shared Responsibility Model

Common Shared Responsibility Model exam traps

Shared Responsibility Model questions

A company uses Amazon RDS to run their production database. Under the AWS Shared Responsibility Model, who is responsible for patching the underlying database engine software?

A company is migrating its on-premises applications to the AWS Cloud. The Chief Security Officer wants to confirm the division of security responsibilities. According to the AWS Shared Responsibility Model, which of the following tasks is the customer's responsibility?

According to the AWS Shared Responsibility Model, which of the following is AWS responsible for?

Under the AWS Shared Responsibility Model, which of the following is the customer's responsibility when using Amazon RDS?

According to the AWS Shared Responsibility Model, which of the following is the customer's responsibility when using AWS Lambda?

According to the AWS Shared Responsibility Model, for which of the following is the customer ALWAYS responsible, regardless of the AWS service used?

Under the AWS Shared Responsibility Model, which scenario correctly demonstrates the customer's responsibility?

An organization needs to sign a Business Associate Agreement (BAA) with AWS to run applications that process Protected Health Information (PHI) under HIPAA. Which statement about AWS and HIPAA is accurate?

A company runs a web application on Amazon EC2 instances. Under the AWS Shared Responsibility Model, who is responsible for patching the operating system on the EC2 instances?

Under the AWS Shared Responsibility Model, what is AWS responsible for when a customer uses AWS Lambda?

Track your progress over time

Start a Shared Responsibility Model only practice session

Related CLF-C02 topic practice pages

Cloud Concepts practice questions

Security and Compliance practice questions

Cloud Technology and Services practice questions

Billing, Pricing, and Support practice questions

AWS shared responsibility model practice questions

AWS IAM practice questions

AWS pricing practice questions

AWS support plans practice questions

AWS S3 practice questions

AWS EC2 practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid