CLF-C02 Shared Responsibility 3 — Questions and Answers
Question 1: A security auditor asks about responsibility for DDoS protection on AWS. Which answer is most accurate?
- The customer is solely responsible for all DDoS protection
- AWS Shield Standard automatically protects all AWS resources from common DDoS attacks at no extra cost (Correct answer)
- DDoS protection is not covered under the Shared Responsibility Model
- Customers must purchase AWS Shield Advanced for any DDoS protection
Correct answer: AWS Shield Standard automatically protects all AWS resources from common DDoS attacks at no extra cost
AWS Shield Standard is included automatically for all AWS customers and provides protection against common network and transport layer DDoS attacks.
Question 2: Under the Shared Responsibility Model, who is responsible for the availability of the AWS global infrastructure?
- The customer, by designing for multi-region redundancy
- AWS, by maintaining its global network and data centers (Correct answer)
- Both share equal responsibility for global availability
- Third-party providers contracted by AWS
Correct answer: AWS, by maintaining its global network and data centers
AWS is responsible for the availability and reliability of its global infrastructure, including regions, Availability Zones, and edge locations.
Question 3: What does 'security IN the cloud' refer to in the AWS Shared Responsibility Model?
- AWS securing its underlying infrastructure
- Customer responsibilities such as data protection, IAM, and OS patching (Correct answer)
- The joint effort between AWS and the customer on all tasks
- AWS's responsibility to secure managed services
Correct answer: Customer responsibilities such as data protection, IAM, and OS patching
'Security IN the cloud' refers to customer responsibilities, including managing data, applications, identity, and operating system configuration.
Question 4: A company uses AWS Organizations with multiple accounts. Under the Shared Responsibility Model, who manages the AWS account root user credentials?
- AWS manages root credentials for security purposes
- The customer is responsible for securing and restricting root user access (Correct answer)
- AWS Support can manage root credentials on behalf of customers
- Root credentials are shared between AWS and the customer
Correct answer: The customer is responsible for securing and restricting root user access
Customers are fully responsible for securing root user credentials, including enabling MFA and avoiding routine use of the root account.
Question 5: Which of the following is AWS responsible for under the Shared Responsibility Model?
- Configuring VPC route tables
- Validating the compliance of customer applications
- Securing the underlying compute hypervisor (Correct answer)
- Setting S3 bucket policies
Correct answer: Securing the underlying compute hypervisor
AWS is responsible for securing the hypervisor layer that supports EC2 instances, as it is part of the foundational infrastructure.
Question 6: A customer accidentally exposes an S3 bucket to the public. Under the Shared Responsibility Model, who is accountable?
- AWS, because it should prevent misconfiguration
- The customer, because S3 bucket policies and ACLs are the customer's responsibility (Correct answer)
- Shared equally between AWS and the customer
- AWS's compliance team, for not detecting the exposure
Correct answer: The customer, because S3 bucket policies and ACLs are the customer's responsibility
Configuring S3 bucket access controls is a customer responsibility, so misconfiguration resulting in public exposure is the customer's accountability.
Question 7: Which statement correctly describes the Shared Responsibility Model for a managed service like Amazon DynamoDB?
- AWS manages the infrastructure and service; the customer manages data access and table configuration (Correct answer)
- The customer manages both the infrastructure and the data
- AWS manages everything including the customer's data permissions
- Managed services have no shared responsibility; AWS owns all tasks
Correct answer: AWS manages the infrastructure and service; the customer manages data access and table configuration
For managed services like DynamoDB, AWS handles infrastructure, while customers control data, access policies, and application logic.
CLF-C02 Shared Responsibility 3
A security auditor asks about responsibility for DDoS protection on AWS.
Which answer is most accurate?