SCS-C03 Security Foundations and Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Patching the underlying virtualization software on the physical host.

  Why it's wrong here

  AWS is responsible for the 'security of the cloud,' which includes the physical infrastructure and the virtualization layer (hypervisor) that runs EC2 instances. Customers do not have access to this layer. AWS ensures that the hypervisor is secure and updated to protect all tenants on the physical host.

• ✗

  Maintaining the physical security of the data centers where instances reside.

  Why it's wrong here

  Physical security is a core component of AWS's responsibility. They manage access controls, surveillance, and environmental protections for their global data center infrastructure. Customers benefit from these controls without needing to manage them, as part of the managed infrastructure services provided by the platform.

• ✓

  Managing and patching the guest operating system installed on the instance.

  Why this is correct

  When a customer launches an EC2 instance, they have full administrative control over the guest operating system. Therefore, the customer is responsible for installing security updates, managing user access, and configuring the OS-level firewall. This is a primary example of security 'in' the cloud.

• ✗

  Disposing of decommissioned physical storage drives in a secure manner.

  Why it's wrong here

  AWS manages the lifecycle of all physical hardware used in their data centers. This includes the secure decommissioning and destruction of storage media according to industry standards like NIST 800-88. Customers are responsible for logically deleting their data, but AWS handles the physical destruction of the hardware.