CLF-C02 Shared Responsibility 2 — Questions and Answers
Question 1: A company stores sensitive customer data in Amazon S3. According to the AWS Shared Responsibility Model, who is responsible for encrypting the data at rest?
- AWS automatically encrypts all S3 data
- The customer is responsible for enabling and managing encryption (Correct answer)
- AWS and the customer share equal responsibility for encryption
- Encryption is handled by the S3 service with no customer action needed
Correct answer: The customer is responsible for enabling and managing encryption
Customers are responsible for protecting their data in S3, including choosing to enable server-side or client-side encryption.
Question 2: Which of the following is an example of AWS's responsibility under the Shared Responsibility Model?
- Configuring security groups for EC2 instances
- Managing IAM user permissions
- Maintaining the physical security of data center facilities (Correct answer)
- Patching the guest operating system on EC2
Correct answer: Maintaining the physical security of data center facilities
AWS is responsible for physical security of its data centers, including facility access controls and environmental safeguards.
Question 3: When using AWS Lambda, which security task is the customer responsible for?
- Patching the underlying Lambda execution environment
- Securing the physical servers running Lambda functions
- Writing secure function code and managing function permissions (Correct answer)
- Managing the Lambda service infrastructure
Correct answer: Writing secure function code and managing function permissions
With Lambda, customers own the function code and must ensure it is secure and that IAM permissions are properly scoped.
Question 4: Under the Shared Responsibility Model, which layer does AWS manage for Amazon RDS?
- Database schema design
- Database user access and permissions
- Database engine patching and updates (Correct answer)
- Stored data backup policies set by the customer
Correct answer: Database engine patching and updates
AWS manages the underlying database engine patching for RDS, which is one of the benefits of using a managed service.
Question 5: A developer wants to understand who is responsible for network traffic protection in AWS. Which statement is accurate?
- AWS is solely responsible for all network traffic protection
- The customer configures security groups and NACLs; AWS protects the physical network (Correct answer)
- Network traffic protection is entirely the customer's responsibility
- AWS and customer split network protection 50/50 with no defined boundary
Correct answer: The customer configures security groups and NACLs; AWS protects the physical network
AWS protects the underlying physical network infrastructure, while customers configure virtual network controls like security groups and NACLs.
Question 6: Which scenario best illustrates a customer's responsibility in the Shared Responsibility Model?
- Ensuring AWS hardware is not stolen from data centers
- Keeping the hypervisor software up to date
- Rotating IAM access keys regularly (Correct answer)
- Maintaining redundancy in the AWS global network
Correct answer: Rotating IAM access keys regularly
Rotating IAM access keys is a customer security best practice that falls entirely under the customer's responsibility.
Question 7: How does the Shared Responsibility Model change when a customer moves from EC2 to AWS Fargate?
- The customer takes on more responsibility for OS management
- AWS takes on more responsibility as it manages the container infrastructure (Correct answer)
- Responsibility remains exactly the same
- The customer becomes responsible for the underlying hardware
Correct answer: AWS takes on more responsibility as it manages the container infrastructure
With Fargate, AWS manages the underlying container infrastructure and OS, reducing the customer's operational responsibilities compared to EC2.
CLF-C02 Shared Responsibility 2
A company stores sensitive customer data in Amazon S3.
According to the AWS Shared Responsibility Model, who is responsible for encrypting the data at rest?