These questions are independently created for study purposes. They are not official AWS exam questions, actual exam questions, leaked questions, or exam dumps.
CLF-009
Under the AWS Shared Responsibility Model, which of the following is most appropriate as the user's responsibility?
Choices
Explanation and answer
Read the explanation and correct answer (spoiler — try answering first)
Correct answer: B. Management of IAM users and permissions
Explanation
Configuring IAM users, IAM roles, policies, and access permissions is the user's responsibility.
Per-choice explanations
A. Physical security of AWS data centers
Incorrect. Physical security is AWS's responsibility.
B. Management of IAM users and permissions
Correct. IAM permission management is the user's responsibility.
C. Maintenance of AWS global network equipment
Incorrect. Maintenance of global infrastructure is AWS's responsibility.
D. Building management of AWS Regions
Incorrect. Data center and facility management is AWS's responsibility.
Practical Use
The AWS Shared Responsibility Model is the basic framework that defines how security responsibilities are divided between AWS and the user. AWS takes responsibility for security OF the cloud itself, including the physical security of data centers, maintenance of hardware, and operation of the hypervisor and managed service infrastructure. The user, on the other hand, takes responsibility for security IN the cloud, including management of IAM users and roles, data classification and encryption, network settings (security group and VPC settings), OS patching (in the case of EC2), and security implementation of applications. The scope of user responsibility varies depending on the service model used. With IaaS, such as EC2, all layers from the OS upward become the user's responsibility, while with managed services such as Lambda or DynamoDB, AWS handles the management of the OS and middleware, allowing the user to focus on IAM permissions, data, and application logic. In practice, the least-privilege design of IAM policies, verification of S3 bucket public settings, and detection of configuration drift via Security Hub or AWS Config are incorporated as routine work to fulfill user responsibility. On CLF-C02, this content frequently appears in the direct form of which of the following is the user's responsibility or which is AWS's responsibility. Typical examples of user responsibility are management of IAM users and permissions, data encryption, and security implementation of applications. Typical examples of AWS responsibility are physical security of data centers, management of Region facilities, and maintenance of global network equipment. Accurately understanding the line of responsibility is the shortcut to the correct answer.