These questions are independently created for study purposes. They are not official AWS exam questions, actual exam questions, leaked questions, or exam dumps.
CLF-031
Under the AWS shared responsibility model, which of the following is typically the customer's responsibility?
Choices
Explanation and answer
Read the explanation and correct answer (spoiler — try answering first)
Correct answer: D. Permission design for IAM users and IAM roles
Explanation
Under the shared responsibility model, AWS is responsible for security of the cloud, and the customer is responsible for security in the cloud. IAM permission design and access management are the customer's responsibility.
Per-choice explanations
A. Replacing the underlying hardware of AWS managed services
Incorrect. Maintenance of the underlying hardware is AWS's responsibility.
B. Management of power equipment in AWS data centers
Incorrect. Management of data center facilities is AWS's responsibility.
C. Physical protection of the AWS global infrastructure
Incorrect. Physical protection of the AWS global infrastructure is AWS's responsibility.
D. Permission design for IAM users and IAM roles
Correct. IAM permission design is the customer's security in the cloud.
Practical Use
The AWS shared responsibility model divides responsibilities between AWS and the customer into security of the cloud and security in the cloud. AWS is responsible for the physical security of data centers, the hardware of servers, storage, and network equipment, the hypervisor and the underlying software of managed services, and operation of the AWS global infrastructure as a whole. The customer is responsible for IAM permission design, OS and middleware patching for IaaS, data encryption, network configuration such as VPC, security groups, and NACLs, application code, and data classification and protection. The scope of customer responsibility shifts based on the service type. For IaaS such as Amazon EC2, everything from the OS up is the customer's responsibility. For managed services such as Amazon RDS, the OS and the database engine itself move to AWS, and the customer becomes responsible for schema design, data, network paths, and IAM authentication. For fully managed services such as Amazon S3 and Amazon DynamoDB, customer responsibility narrows further to data and access control. For serverless services such as AWS Lambda, the function code and the IAM execution role remain the customer's responsibility. On the exam, this concept appears in questions that ask which of the following items is the customer's responsibility. IAM permission design, data encryption, security group rule configuration, and guest OS patching appear as correct answers. Distractors list items that are clearly on the AWS side, such as managing power equipment in a data center, physical protection of the global infrastructure, or replacing the underlying hardware of managed services. On CLF-C02, this boundary is frequently tested.