FirstTry

Objective 2.1

CLF-C02

Understand the AWS shared responsibility model.

Objective 2.1 sits in Security and Compliance, which carries 30% of the Cloud Practitioner exam. The questions below are original, written from the official objective title above, and each explanation cites the Amazon Web Services (AWS) page it rests on.

Objective title verbatim from the official objectives. Amazon Web Services (AWS) exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

2-1Security and Compliance

A team runs an application on Amazon EC2. Under the AWS shared responsibility model, who applies security patches to the instance's guest operating system?

AWS, as part of infrastructure maintenanceAWS patches the hardware, hypervisor and facilities underneath. It would own guest patching only on an abstracted service where no guest OS is exposed.
AWS for the kernel, the customer for packagesNo such split exists. The kernel ships inside the guest image the customer chose, so it sits on the customer side along with everything else in that image.
The AMI vendor who published the imagePublishing an image does not carry a duty to maintain it after launch. Once the instance is running, the account that launched it owns what happens inside.
The customer who deployed the instanceCorrect · your answerCorrect. AWS states that customers deploying an EC2 instance are responsible for management of the guest operating system, including updates and security patches.

Correct.

Checked against aws.amazon.com, August 2026

Concept

Responsibility follows control. Each layer of a running workload belongs to whoever can change it, so the dividing line sits wherever the provider stops configuring and the subscriber starts.

Why D

EC2 is infrastructure as a service, so everything above the hypervisor is configured by whoever launched the instance. That includes the operating system image, its updates, and its patches.

Source

Customers that deploy an Amazon EC2 instance are responsible for management of the guest operating system (including updates and security patches), any application software or utilities installed by the customer on the instances, and the configuration of the AWS-provided firewall (called a security group) on each instance…

AWS: Shared Responsibility Model, checked August 2026
#shared-responsibility#ec2#patching

Now you: objective 2.1 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

2-1Security and Compliance

AWS distinguishes security of the cloud from security in the cloud. What does security of the cloud cover?

Sample question 2 of 3

2-1Security and Compliance

A company stores objects in Amazon S3 and items in Amazon DynamoDB. For these abstracted services, what remains the customer's responsibility?

Sample question 3 of 3

2-1Security and Compliance

AWS trains its own employees on security and a customer trains theirs. Which control category does AWS use for that arrangement?

That’s 3 of the full Cloud Practitioner bank.

Keep going free: 10 questions per certification in bank practice, with no account.

Continue practicing

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Security and Compliance