Welcome to Part 3 of our dedicated preparation series for the AWS Certified Cloud Practitioner (CLF-C02) certification. Security and compliance make up one of the highest-weighted domains on the exam. While reviewing official documentation is essential, analyzing realistic scenario-based questions is the most effective way to master the division of security boundaries defined under the AWS Shared Responsibility Model and prepare for your certification test.
 |
| AWS Certified Cloud Practitioner (CLF-C02) Practice Test - Shared Responsibility Model & Compliance |
In this aws cloud practitioner practice test free study module (Part 3), we break down 20 high-yield questions (Questions 1 through 20) evaluating the AWS Shared Responsibility Model & Compliance. You will test your understanding of "Security OF the Cloud" versus "Security IN the Cloud," customer firewall and IAM configurations, AWS Artifact compliance reports, and regulatory audit standards. Every question includes a thorough technical explanation detailing why the correct answer is right and why the distractor options are incorrect.
AWS Cloud Practitioner (CLF-C02) Practice Questions
Q1: AWS Shared Responsibility Model (Multiple Choice)
Operating securely in the cloud requires understanding how responsibilities are divided between the cloud provider and the customer.
According to the AWS Shared Responsibility Model, which of the following tasks are the responsibility of AWS? (Select 2)
• Sanitizing physical hardware (Security OF the Cloud): AWS is responsible for the physical security of data centers and the strict decommission protocols (such as NIST-compliant media sanitization and shredding) for defective hard drives and storage hardware.
• Hypervisor patching: AWS manages and patches the physical servers, networking gear, and the underlying virtualization hypervisor layer that isolates multi-tenant virtual machines.
Why are the other options incorrect?
• EC2 Guest OS patching: In Amazon EC2 (IaaS), the customer is directly responsible for maintaining and patching the guest operating system.
• IAM MFA configuration: Provisioning IAM users, enforcing credential policies, and enabling MFA are 100% customer responsibilities.
• VPC Security Groups: Configuring virtual firewall rules to restrict inbound/outbound instance traffic is a customer responsibility.
Q2: Managed Services & Security Boundaries
Determine whether the following statement is Yes (True) or No (False):
"When using an AWS managed service, the customer is no longer responsible for any security or compliance controls because AWS manages the underlying infrastructure."
While AWS manages the underlying physical infrastructure, host operating system, and database software for managed services (such as Amazon RDS, DynamoDB, or S3), security remains a shared responsibility. Customers are still strictly responsible for managing identity and access permissions (IAM), encrypting sensitive data, configuring network access points, and ensuring application-level compliance.
Q3: Amazon RDS & Customer Responsibilities
Transitioning a relational database from an on-premises data center to Amazon RDS offloads infrastructure management to AWS.
Which administrative task remains the direct responsibility of the customer after migrating to Amazon RDS?
• Customer Responsibility in Amazon RDS: Amazon RDS is a managed Platform as a Service (PaaS). While AWS automates hardware provisioning, OS maintenance, and routine software patching, the customer remains responsible for table schema design, data indexing, SQL query tuning, and managing database engine user accounts.
Why are the other options incorrect?
• Physical maintenance: AWS manages all data center hardware, physical server racking, and power.
• Host OS updates: AWS automatically manages and patches the underlying operating system during configured maintenance windows.
• Replacing hard drives: Storage array management and drive replacement are fully abstracted and handled by AWS.
Q4: Cloud Security & IAM Access Governance
Transitioning workloads to the AWS Cloud offloads underlying infrastructure maintenance to AWS.
According to the AWS Shared Responsibility Model, which operational task remains the direct responsibility of the customer?
• Security IN the Cloud: Under the Shared Responsibility Model, the customer is responsible for managing IAM user identities, defining role-based access policies, enforcing strong password requirements, and securing their application data.
Why are the other options incorrect?
• Replacing storage drives: Managing and replacing physical disk hardware is the exclusive responsibility of AWS.
• Physical data center security: Perimeter fencing, video surveillance, and biometric access controls are managed entirely by AWS.
• Aurora storage replication: Automated storage replication across multiple Availability Zones is a managed infrastructure feature provided by AWS.
Q5: Infrastructure Security & AWS Responsibilities
Under the AWS Shared Responsibility Model, AWS manages specific operational and security duties for cloud infrastructure and managed services.
Which of the following tasks are the responsibility of AWS? (Select 2)
• Amazon RDS OS Patching: In managed database services, AWS maintains the operating system layer and applies patches automatically.
• Hypervisor Maintenance: Securing, maintaining, and updating the virtualization layer across physical host machines is part of AWS's responsibility for "Security OF the Cloud."
Why the other choices are incorrect:
• Amazon EC2 Guest OS: In IaaS, managing and patching the operating system is the customer's responsibility.
• IAM credentials & MFA: Creating user accounts and enforcing MFA are customer security configurations.
• Security groups & Network ACLs: Defining network traffic filtering rules is managed by the customer.
Q6: Amazon EC2 Customer Responsibilities (Select 2)
Running virtual servers on Amazon EC2 requires users to manage specific security and maintenance tasks on their compute instances.
According to the AWS Shared Responsibility Model, which of the following tasks are the responsibility of the customer for Amazon EC2 instances? (Select 2)
• Guest OS Patching: For Amazon EC2 (Infrastructure as a Service), the customer is fully responsible for installing, configuring, and updating the guest operating system (e.g., Linux or Windows).
• EBS Volume Encryption: Customers are responsible for data security, including configuring server-side or client-side encryption on attached Amazon EBS storage volumes.
Why the other choices are incorrect:
• Physical data center security: Controlled, monitored, and secured 100% by AWS.
• Virtualization hypervisor: The hypervisor software running on physical host machines is managed and secured exclusively by AWS.
• Physical hardware replacement: Power, cooling, server racks, and physical network cabling are maintained entirely by AWS.
Q7: AWS Compliance & Governance Services (Matching)
Match each description below to its corresponding AWS Service:
1. Provides on-demand access to AWS security and compliance reports and certifications:
2. Helps collect and manage evidence to support compliance audits and assessments:
3. Records and monitors API activity and actions performed in an AWS account:
• Description 1 matches AWS Artifact: AWS Artifact is the central compliance portal that provides on-demand downloads of AWS security and compliance reports (such as SOC 1/2/3, ISO, and PCI DSS certifications) and legal agreements.
• Description 2 matches AWS Audit Manager: AWS Audit Manager helps automate continuous evidence collection and assessment mapping to evaluate whether cloud usage complies with industry frameworks.
• Description 3 matches AWS CloudTrail: AWS CloudTrail continuously logs, monitors, and retains account activity related to actions taken across your AWS infrastructure (via AWS Management Console, SDKs, or CLI).
Q8: AWS Lambda & Serverless Responsibilities
Running serverless applications on AWS Lambda shifts server provisioning, operating system patching, and infrastructure scaling to AWS.
According to the AWS Shared Responsibility Model, which task remains the direct responsibility of the customer?
• Serverless Shared Responsibility: In serverless architectures like AWS Lambda, the customer is responsible for "Security IN the Cloud." This includes writing secure application code, managing third-party dependencies/libraries, configuring environment variables, and assigning appropriate IAM execution roles.
Why are the other options incorrect?
• Host OS security patching: AWS manages the runtime environment, underlying operating system, and container isolation layer.
• Shutting down compute instances: AWS Lambda automatically provisions and de-provisions compute capacity on demand per event trigger.
• Physical hardware maintenance: Physical servers, storage arrays, cooling, and facility infrastructure are 100% managed by AWS.
Q9: Customer Security & IAM Least Privilege
Under the AWS Shared Responsibility Model, which of the following security tasks is the direct responsibility of the customer?
• IAM Governance (Customer Responsibility): Customers are 100% responsible for creating IAM users, roles, and groups, defining granular access policies, and enforcing the principle of least privilege across their accounts.
Why are the other options incorrect?
• DynamoDB OS patching: Amazon DynamoDB is a managed serverless database where OS patching is handled automatically by AWS.
• Edge Location physical security: Physical security at AWS data centers and CloudFront edge locations is strictly managed by AWS.
• Physical hardware decommissioning: Physical hardware maintenance, media sanitization, and equipment disposal are the exclusive responsibility of AWS.
Q10: Shared Controls & Patch Management
Under the AWS Shared Responsibility Model, certain security duties are classified as "Shared Controls," where both AWS and the customer play active roles.
Which of the following responsibilities is considered a shared control?
• Shared Controls Concept: AWS defines specific controls that apply to both AWS and the customer:
- Patch Management: AWS is responsible for patching physical host servers and managed service platforms, while the customer is responsible for patching guest operating systems on Amazon EC2.
- Configuration Management: AWS configures its infrastructure devices, while the customer configures their guest OS, databases, and applications.
- Awareness & Training: AWS trains AWS employees; customers train their own staff.
Why are the other options incorrect?
• Physical perimeter security: Exclusively an AWS responsibility ("Security OF the Cloud").
• EC2 guest OS configuration: Exclusively a customer responsibility ("Security IN the Cloud").
• Client-side encryption: Exclusively a customer data security responsibility.
Q11: Amazon DynamoDB & Access Governance
When deploying a serverless NoSQL database using Amazon DynamoDB, which security task is the customer's direct responsibility under the AWS Shared Responsibility Model?
• DynamoDB Security (Security IN the Cloud): Amazon DynamoDB is a fully managed serverless database. While AWS manages the host infrastructure, customers remain strictly responsible for defining IAM policies, configuring table access permissions, and managing client-side security controls.
Why are the other options incorrect?
• Physical facility security: Managed exclusively by AWS under "Security OF the Cloud."
• OS and software updates: In managed serverless databases, AWS automatically applies OS and database engine security patches.
• Hardware-level replication: Multi-AZ storage replication and disk-level fault tolerance are fully automated by AWS.
Q12: Overall Cloud Security & Compliance
Under the AWS Shared Responsibility Model, which of the following overall operational domains represents a shared responsibility between AWS and the customer?
• Shared Responsibility Framework: Managing overall cloud security and compliance is a shared endeavor. AWS is responsible for Security OF the Cloud (physical facilities, hardware, and the virtualization layer), while the customer is responsible for Security IN the Cloud (customer data, IAM policies, guest OS patching, and network configurations).
Why are the other options incorrect?
• Physical hardware cabling: Exclusively managed by AWS.
• EC2 guest operating system: Exclusively managed by the customer.
• Physical perimeter protection: Exclusively managed by AWS.
Q13: Amazon WorkSpaces & Physical Infrastructure
A company provisions cloud virtual desktops for its remote employees using Amazon WorkSpaces.
Under the AWS Shared Responsibility Model, which of the following tasks is the direct responsibility of AWS?
• AWS Physical Security: AWS is responsible for securing the physical data centers, host servers, power redundancy, and cooling systems that support Amazon WorkSpaces infrastructure.
Why are the other options incorrect?
• MFA for WorkSpaces users: Enforcing multi-factor authentication and user password policies is a customer identity responsibility.
• AWS CloudTrail monitoring: Enabling audit logging and analyzing API activity across accounts is managed by the customer.
• IAM user permissions: Creating desktop administrator accounts and managing access control policies are customer tasks.
Q14: AWS Shared Responsibility Boundaries (Yes/No)
Review the three statements below regarding the AWS Shared Responsibility Model. Determine whether each statement is Yes (True) or No (False):
1. AWS is responsible for securing physical infrastructure, including data centers, networking equipment, and physical servers supporting cloud services.
2. When deploying Amazon EC2 instances, AWS is responsible for installing security patches and updates on the guest operating system.
3. When using Amazon EC2, the customer is responsible for configuring security groups that control inbound and outbound network traffic.
• Statement 1 is True (Yes): AWS manages "Security OF the Cloud," which includes the physical security of data center buildings, power feeds, environmental cooling, server hardware, and physical network switches.
• Statement 2 is False (No): In Amazon EC2 (IaaS), AWS manages up to the virtualization hypervisor layer. The customer is entirely responsible for installing, updating, and patching the guest operating system (Linux or Windows).
• Statement 3 is True (Yes): Security groups act as virtual firewalls at the instance level. Customers are 100% responsible for authoring inbound and outbound port rules to permit legitimate traffic and block unauthorized access.
Q15: AWS Compliance Resources & AWS Artifact (Yes/No)
Review the three statements below regarding AWS compliance resources and reporting. Determine whether each statement is Yes (True) or No (False):
1. AWS Artifact provides on-demand self-service access to AWS security and compliance reports, ISO certifications, and SOC audit attestations.
2. AWS Artifact is primarily designed to scan Amazon EC2 instances and container images for active software vulnerabilities.
3. Customers can download compliance documentation from AWS to verify and support their own internal regulatory audit requirements.
• Statement 1 is True (Yes): AWS Artifact is the official portal for downloading AWS third-party compliance reports (such as SOC 1/2/3, PCI DSS packages, and ISO 27001 certifications) and executing compliance agreements like the Business Associate Addendum (BAA).
• Statement 2 is False (No): Common Exam Trap: AWS Artifact does not scan code or detect vulnerabilities. Automated vulnerability scanning across EC2 instances, Lambda functions, and container images is performed by Amazon Inspector.
• Statement 3 is True (Yes): While AWS compliance does not automatically make customer applications compliant, customers can use AWS's compliance attestations as evidence to satisfy their external auditors.
Q16: Shared Responsibility Control Categories (Matching)
Match each description below to its corresponding Responsibility Category:
1. Securing AWS physical data centers, environmental controls, and host hardware:
2. Managing guest operating system security patches and firewall rules for an Amazon EC2 instance:
3. Patch management, configuration management, and awareness training where both parties play active roles:
• Description 1 matches AWS Responsibility: Known as Inherited Controls, customers automatically inherit physical security, environmental safeguards, and datacenter access protection directly from AWS.
• Description 2 matches Customer Responsibility: Known as Customer-Specific Controls, the customer solely manages the security of their applications, guest operating systems, and network firewalls.
• Description 3 matches Shared Responsibility: Known as Shared Controls (Patch Management, Configuration Management, Awareness & Training), AWS secures its foundational infrastructure while the customer secures their guest OS and internal processes.
Q17: Compliance Reports & AWS Artifact
Preparing for a regulatory security audit requires downloading official AWS compliance documentation, including SOC reports, ISO certifications, and Payment Card Industry (PCI DSS) attestations.
Which AWS service provides self-service, on-demand access to these official security and compliance reports?
• AWS Artifact: The central self-service compliance portal where customers can access and download on-demand AWS security audit documents—including SOC 1/2/3 reports, PCI DSS compliance packages, and ISO certifications—as well as legal agreements like the Business Associate Addendum (BAA).
Why are the other options incorrect?
• Amazon Inspector: An automated vulnerability assessment service that continuously scans Amazon EC2 instances, Lambda functions, and container images for software vulnerabilities.
• AWS Trusted Advisor: Provides automated recommendations for optimizing costs, security, performance, and service quotas.
• AWS Security Hub: A security posture management service that aggregates and prioritizes security alerts across AWS accounts.
Q18: Amazon DynamoDB & AWS Responsibilities
Running workloads on a fully managed service such as Amazon DynamoDB changes how maintenance and security duties are shared between the user and AWS.
According to the AWS Shared Responsibility Model, which of the following tasks are the responsibility of AWS? (Select 2)
• Managed Serverless Maintenance: For Amazon DynamoDB, AWS manages the physical server fleet, applies host OS patches automatically, and replicates table data across multiple Availability Zones.
Why the other choices are incorrect:
• IAM table policies: Creating fine-grained IAM policies to restrict user access to table records is a customer security task.
• Data classification: Determining data sensitivity, compliance tagging, and retention schedules are customer duties.
• KMS Key configuration: Managing customer-managed encryption keys in AWS KMS is controlled by the customer.
Q19: AWS Compliance Inheritance
Determine whether the following statement is Yes (True) or No (False):
"AWS compliance certifications automatically make a customer's workloads compliant with every regulatory requirement that applies to the customer's business."
• Shared Compliance Principle: AWS compliance certifications (such as SOC, ISO 27001, and HIPAA compliance of the underlying infrastructure) do not automatically make a customer's application compliant. The customer remains responsible for securing their own applications, configuring access controls, encrypting data, and implementing organizational policies required by their regulatory bodies.
Q20: Customer Responsibilities in the Cloud
A company is running workloads on AWS and wants to understand which security tasks remain its responsibility under the AWS Shared Responsibility Model.
Which TWO of the following are responsibilities of the customer? (Select 2)
• Security IN the Cloud: Customers are responsible for managing the guest operating system on EC2 instances (including security patching and software updates) and managing access governance via IAM users, roles, and policies.
Why the other choices are incorrect:
• Physical data center security: Managed 100% by AWS.
• Virtualization hypervisor layer: Managed 100% by AWS.
• Replacing physical servers: Hardware maintenance and replacement are managed entirely by AWS.
Key Takeaways for Shared Responsibility & Compliance (Part 3 Summary)
• Security OF the Cloud vs. Security IN the Cloud: AWS manages Security OF the Cloud, covering physical data center facilities, environmental protection, host servers, network cabling, and the virtualization hypervisor. The customer manages Security IN the Cloud, including customer data, IAM access credentials, guest operating system updates, network firewalls (security groups), and application code.
• Responsibilities Across Cloud Service Models: In IaaS (Amazon EC2), the customer manages the guest OS, software, and firewall rules. In PaaS/Managed Services (Amazon RDS, DynamoDB), AWS patches the OS and database software, while the customer manages data and IAM. In Serverless (AWS Lambda), AWS manages runtime execution and capacity, while the customer manages application code and execution roles.
• Shared Controls: Certain controls are shared between AWS and the customer: Patch Management (AWS patches physical infrastructure; customer patches guest OS), Configuration Management (AWS configures its network hardware; customer configures databases and applications), and Awareness & Training.
• AWS Artifact Compliance Portal: AWS Artifact is the central repository for downloading on-demand third-party compliance reports (SOC 1/2/3, ISO 27001, PCI DSS packages) and executing legal compliance agreements (such as the Business Associate Addendum - BAA).
• Compliance Inheritance Limits: Deploying workloads on AWS does not automatically make a customer's business compliant. Customers inherit physical security controls from AWS but must design their application architecture to satisfy industry-specific regulatory standards.
Frequently Asked Questions (AWS CLF-C02 FAQ)
1. What is the fundamental difference between "Security OF the Cloud" and "Security IN the Cloud"?
Under the AWS Shared Responsibility Model, Security OF the Cloud describes the physical facilities, hardware, and core virtualization software managed exclusively by AWS. This includes securing physical data centers, servers, storage media disposal, and hypervisors. Conversely, Security IN the Cloud encompasses everything the customer provisions, configures, and stores in AWS. Customers are fully responsible for managing customer data, encrypting traffic, configuring Identity and Access Management (IAM) user permissions, defining virtual firewall rules in security groups, and patching the guest operating system on infrastructure like Amazon EC2.
2. What is AWS Artifact, and how does it differ from Amazon Inspector?
AWS Artifact is an on-demand, self-service compliance portal where customers can download official AWS audit documents, including SOC reports, ISO certifications, and PCI DSS packages, as well as accept legal agreements like the Business Associate Addendum (BAA). In contrast, Amazon Inspector is an automated vulnerability management service that actively scans running Amazon EC2 instances, Lambda functions, and container images for software vulnerabilities and unintended network exposure. AWS Artifact provides static compliance audit reports, whereas Amazon Inspector performs active automated security scanning.
3. How does patch management operate as a "Shared Control" in AWS?
Patch management is officially categorized as a Shared Control because both AWS and the customer have distinct, non-overlapping responsibilities. AWS is responsible for patching and maintaining the physical host hardware, network switches, hypervisors, and underlying operating systems of managed platform services like Amazon DynamoDB and Amazon RDS. The customer is responsible for patching and updating the guest operating system, third-party applications, and custom software running inside their unmanaged compute instances, such as Amazon EC2 virtual servers.
4. Does hosting applications on AWS automatically make a business regulatory compliant?
No. While AWS maintains extensive compliance accreditations (including SOC 1/2/3, ISO 27001, FedRAMP, and PCI DSS Level 1), these certifications only validate the security of the underlying cloud infrastructure. Hosting a workload on AWS allows organizations to inherit foundational physical and environmental controls, but customers remain fully responsible for implementing access policies, data encryption at rest and in transit, audit logging with AWS CloudTrail, and application controls required to achieve full compliance for their specific business.
Ready to See Your Results?
Congratulations on completing this aws cloud practitioner practice test free module! Mastering the boundary lines of the Shared Responsibility Model is essential for passing the AWS Certified Cloud Practitioner (CLF-C02) exam with a high score.
Click the button above to calculate your final score, leave a comment with your result, and continue to Part 4 to master AWS IAM and Security Best Practices!
