Task Statement 2.1: Understand the AWS Shared Responsibility Model. CLF-C02 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A startup is deploying a customer-facing web application on an Amazon EC2 instance. The security team has implemented a strong password policy for the application's user database, but they are unsure who is responsible for patching the operating system of the EC2 instance. According to the AWS shared responsibility model, who is responsible for applying the OS security patches?

   • AThe customer, because they control the operating system and its configuration on the EC2 instance.
   • BAWS, because it provides the EC2 service and all its components.
   • CAWS, because it manages the underlying hypervisor and physical host.
   • DThe customer, but only if they are using a managed service like Amazon RDS.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company is using AWS Lambda for a serverless application. The security team is reviewing the shared responsibility model for this service. Which of the following is the customer responsible for?

   • AManaging the physical servers that run the Lambda service.
   • BWriting and configuring the Lambda function code and its permissions.
   • CPatching the underlying operating system that runs the Lambda function.
   • DManaging the runtime environment of the Lambda service.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company is migrating its on-premises data center to AWS. The CISO wants to ensure that the physical security of the data centers, such as access controls and video surveillance, is handled by a third party. Which of the following is the correct interpretation of the shared responsibility model for this requirement?

   • AThe customer must contract a third-party security firm to audit AWS data centers.
   • BAWS is responsible for physical security, including access controls and surveillance, as part of its responsibility for the physical infrastructure.
   • CPhysical security is a shared responsibility, with AWS managing the perimeter and the customer managing the server racks.
   • DThe customer is responsible for physical security because they are using AWS services.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A company uses AWS Identity and Access Management (IAM) to control access to its resources. Who is responsible for configuring IAM policies and roles?

   • AAWS, because IAM is a managed service
   • BThe customer, because IAM configuration is part of the customer's responsibility for identity and access management
   • CBoth AWS and the customer equally, because IAM is a shared service
   • DAWS, because IAM is part of the global infrastructure
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   A security auditor is reviewing the division of responsibilities for an Amazon RDS database instance. Which item is AWS responsible for?

   • AOptimizing query performance for the application
   • BPatching the underlying operating system of the RDS instance
   • CConfiguring the security group for the RDS instance
   • DManaging database user permissions
   Reveal Solution Discussion Select an answer first