ExamPark
Course menuCLF-C02

Exams / CLF-C02 / Shared responsibility model / Question 2

CLF-C02 practice question: Shared responsibility model (2 of 3)

Security and Compliance A free question from our original CLF-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A healthcare company stores patient scans in Amazon S3 for ten years.

The bucket must be readable only by one application role, and all other access must be blocked, even for staff with console access.

Under the AWS shared responsibility model, which task belongs to the company?

Choose one answer.

  1. A. Setting IAM and bucket policies so only the application role has access
  2. B. Patching the operating systems on the servers that run the Amazon S3 service
  3. C. Replacing failed storage devices that hold the data for the S3 service
  4. D. Running the facilities and network infrastructure that host the S3 service
Show the answer and explanation

Answer: A

  • A. Right: Correct. Customers manage their data and use IAM tools and bucket policies to decide who can access it. AWS cannot know which role should read the company's objects. Learn more: AWS Shared Responsibility Model (opens in a new tab)
  • B. Wrong: Incorrect. AWS operates the operating systems and platforms behind S3 as part of the infrastructure it runs. Customers never patch the servers that S3 uses.
  • C. Wrong: Incorrect. Replacing failed storage hardware is an AWS infrastructure task, carried out in AWS data centers. The company does not manage the devices that store its objects.
  • D. Wrong: Incorrect. AWS runs the facilities and networks that host S3 and protects them. The company does not control the physical or network layer of the service.

Explanation

For abstracted services like S3, AWS runs the infrastructure, operating systems and platforms, while customers manage their data and access. Setting IAM permissions and bucket policies is therefore a customer task. The other three tasks sit in AWS's infrastructure layer.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free CLF-C02 practice examPractice Shared responsibility modelAll Shared responsibility model questions

Want more on Shared responsibility model? The 5 full-length practice sets have 12 more Shared responsibility model questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets