Shared responsibility model: CLF-C02 study notes and practice questions
What to know about Shared responsibility model for the CLF-C02 exam, from the Security and Compliance domain (30% of the exam guide), then 3 free questions to test it. Part of the CLF-C02 study guide.
The shared responsibility model appears on almost every Cloud Practitioner exam. The question is always the same: is this task AWS’s job or the customer’s?
The split
AWS: security of the cloud
Customer: security in the cloud
Physical data centers and their security
Customer data, and who can access it
Hardware, storage and networking equipment
IAM users, roles, policies and MFA
The global network
Security groups and network ACL rules
The virtualization layer
Operating system patches on EC2
Managed service software (for example, the RDS database engine patching)
Application code and its security
Decommissioning old disks
Encryption choices for data at rest and in transit
It depends on the service
Infrastructure services (EC2): the customer manages the guest operating system, patches, installed software, firewalls (security groups) and data.
Managed services (RDS): AWS patches the operating system and database engine; the customer manages database users, network access and data.
Abstracted services (S3, DynamoDB, Lambda): AWS runs the platform; the customer manages data, access permissions and encryption settings.
The more managed the service, the more AWS takes on. Data and access are always the customer’s.
Shared controls
Some controls apply to both, each in their own layer: patch management (AWS patches the infrastructure, you patch your guest systems), configuration management and awareness and training.
Common traps
“AWS patches EC2 instances.” It doesn’t; the customer patches the guest OS.
“AWS decides who can read my S3 bucket.” Access is always the customer’s job.
Physical security. Always AWS. Customers can’t visit AWS data centers.
A company runs its web application on Amazon EC2 instances inside a virtual private cloud.
Its security team asks which tasks it must perform itself under the AWS shared responsibility model, and which AWS handles on its behalf.
Which task is the company's responsibility?
Choose one answer.
AA. Maintaining physical security at the AWS data centers and facilities
BB. Replacing failed disks in the physical host servers that AWS runs
CC. Configuring the security group rules that control traffic to each instance
DD. Patching the virtualization layer on the physical hosts that AWS runs
Show the answer and explanation
Answer: C
A. Wrong: Incorrect. Physical security of AWS data centers is part of the AWS infrastructure, which AWS protects. The company does not manage access to the facilities.
B. Wrong: Incorrect. Replacing failed hardware in AWS host servers is an AWS infrastructure task. Customers never see or manage those physical disks.
D. Wrong: Incorrect. AWS patches the virtualization layer and host systems as part of the infrastructure it runs, so customers do not patch that layer.
Explanation
AWS is responsible for the infrastructure: facilities, hardware, networking and the virtualization layer. For EC2, customers are responsible for what they configure on and run inside each instance, including the security group rules that control which traffic reaches it.
B. Wrong: Incorrect. AWS operates the operating systems and platforms behind S3 as part of the infrastructure it runs. Customers never patch the servers that S3 uses.
C. Wrong: Incorrect. Replacing failed storage hardware is an AWS infrastructure task, carried out in AWS data centers. The company does not manage the devices that store its objects.
D. Wrong: Incorrect. AWS runs the facilities and networks that host S3 and protects them. The company does not control the physical or network layer of the service.
Explanation
For abstracted services like S3, AWS runs the infrastructure, operating systems and platforms, while customers manage their data and access. Setting IAM permissions and bucket policies is therefore a customer task. The other three tasks sit in AWS's infrastructure layer.
A compliance lead is documenting who is responsible for each control in a new AWS workload.
AWS documentation describes shared controls, where AWS and the customer each have a part to play in their own layer.
Which TWO of the following are shared controls? (Choose two.)
Choose two answers.
AA. Physical and environmental controls at AWS data centers, such as power and cooling
BB. Patch management, covering AWS infrastructure and customer guest operating systems
CC. Routing or zoning data within specific security environments for a workload
DD. Awareness and training, where AWS trains its staff and customers train theirs
EE. Choosing the encryption options for data stored in Amazon S3 buckets
Show the answer and explanation
Answers: B, D
A. Wrong: Physical and environmental controls are inherited from AWS. AWS runs the facilities, power and cooling, and the customer does not share that control.
C. Wrong: Routing or zoning data within a security environment is a customer-specific control, because it depends on how the customer designs its own application and network.
D. Right: Correct. AWS trains its own employees and customers train theirs, so awareness and training is a shared control that each party carries out in its own layer.
E. Wrong: Choosing encryption options for data stored in S3 is the customer's responsibility. This is a customer-only control rather than a shared one.
Explanation
Shared controls are split by layer. AWS patches and configures its own infrastructure while customers do the same for their guest systems, and both sides train their own staff. Physical controls are inherited entirely from AWS, while zoning within a workload and encryption choices are the customer's alone.
Want more on Shared responsibility model? The 5 full-length practice sets have 12 more Shared responsibility model questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →