CLF-C02 Shared Responsibility 5 — Questions and Answers
Question 1: A startup uses Amazon EKS (Elastic Kubernetes Service). Under the Shared Responsibility Model, who is responsible for securing the Kubernetes control plane?
- The customer manages the control plane entirely
- AWS manages the EKS control plane; customers manage their worker nodes and workloads (Correct answer)
- Control plane security is shared 50/50 between AWS and the customer
- The Kubernetes community is responsible for control plane security on EKS
Correct answer: AWS manages the EKS control plane; customers manage their worker nodes and workloads
AWS manages and secures the EKS control plane, while customers are responsible for their worker nodes, pod security, and application workloads.
Question 2: Under the Shared Responsibility Model, which of the following is always the customer's responsibility regardless of which AWS service is used?
- Patching the underlying OS of managed services
- Managing physical access to AWS data centers
- Controlling who has access to their AWS account and resources (Correct answer)
- Maintaining the AWS global network
Correct answer: Controlling who has access to their AWS account and resources
Access management — including IAM users, roles, and policies — is always the customer's responsibility across all AWS services.
Question 3: An enterprise asks whether AWS is responsible for preventing data breaches caused by a customer's weak IAM password policy. What does the Shared Responsibility Model say?
- Yes, AWS should enforce strong password policies for all accounts
- No, configuring IAM password policies is the customer's responsibility (Correct answer)
- AWS automatically enforces strong password policies by default
- Both AWS and the customer share responsibility for password policy enforcement
Correct answer: No, configuring IAM password policies is the customer's responsibility
IAM password policies are configured by the customer, so the responsibility for enforcing strong passwords rests entirely with the customer.
Question 4: Which of the following infrastructure components is AWS responsible for under the Shared Responsibility Model?
- VPC subnet configuration
- Security group rules for EC2 instances
- Fiber optic cables and networking hardware connecting AWS regions (Correct answer)
- S3 bucket versioning settings
Correct answer: Fiber optic cables and networking hardware connecting AWS regions
The physical network hardware and fiber connections between AWS facilities are part of the global infrastructure that AWS is fully responsible for.
Question 5: A team uses AWS Config to monitor resource configurations. Under the Shared Responsibility Model, who is responsible for setting up and interpreting AWS Config rules?
- AWS automatically configures Config rules for all accounts
- The customer is responsible for defining and managing AWS Config rules (Correct answer)
- AWS Support manages Config rules as part of the service
- Config rules are pre-configured and cannot be modified by customers
Correct answer: The customer is responsible for defining and managing AWS Config rules
AWS Config is a customer-configured service; customers define the rules and are responsible for evaluating and acting on compliance findings.
Question 6: Under the Shared Responsibility Model, who is responsible for ensuring high availability of a web application deployed on AWS?
- AWS guarantees application-level availability as part of its SLA
- The customer is responsible for designing the application for high availability using AWS services (Correct answer)
- AWS automatically makes all deployed applications highly available
- High availability is jointly designed by AWS and the customer together
Correct answer: The customer is responsible for designing the application for high availability using AWS services
While AWS provides highly available infrastructure, customers must architect their applications to use multiple AZs and fault-tolerant design patterns.
Question 7: Which of the following best describes how the Shared Responsibility Model applies to AWS Elastic Beanstalk?
- AWS manages the entire stack including the application code
- Customers manage infrastructure; AWS manages the application layer
- AWS manages the environment infrastructure; customers are responsible for their application code and data (Correct answer)
- Elastic Beanstalk has no shared responsibility — the customer owns everything
Correct answer: AWS manages the environment infrastructure; customers are responsible for their application code and data
Elastic Beanstalk is a managed platform where AWS handles the provisioning and management of infrastructure, but customers own and are responsible for their application code and data.
CLF-C02 Shared Responsibility 5
A startup uses Amazon EKS (Elastic Kubernetes Service).
Under the Shared Responsibility Model, who is responsible for securing the Kubernetes control plane?