2.1 Understand the AWS shared responsibility model.
Objective 2.1 sits in Security and Compliance, which carries 30% of the Cloud Practitioner exam. The questions below are original, written from the official objective title above, and each explanation cites the AWS page it rests on.
Objective title verbatim from the official objectives. AWS exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
A team runs an application on Amazon EC2. Under the AWS shared responsibility model, who applies security patches to the instance's guest operating system?
The concept
Responsibility follows control. Each layer of a running workload belongs to whoever can change it, so the dividing line sits wherever the provider stops configuring and the subscriber starts.
Why this answer
EC2 is infrastructure as a service, so everything above the hypervisor is configured by whoever launched the instance. That includes the operating system image, its updates, and its patches.
- AAWS patches the hardware, hypervisor and facilities underneath. It would own guest patching only on an abstracted service where no guest OS is exposed.
- Correct. AWS states that customers deploying an EC2 instance are responsible for management of the guest operating system, including updates and security patches.
- CNo such split exists. The kernel ships inside the guest image the customer chose, so it sits on the customer side along with everything else in that image.
- DPublishing an image does not carry a duty to maintain it after launch. Once the instance is running, the account that launched it owns what happens inside.
Now you: objective 2.1 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
AWS distinguishes security of the cloud from security in the cloud. What does security of the cloud cover?
Sample question 2 of 3
A company stores objects in Amazon S3 and items in Amazon DynamoDB. For these abstracted services, what remains the customer's responsibility?
Sample question 3 of 3
AWS trains its own employees on security and a customer trains theirs. Which control category does AWS use for that arrangement?
That’s 3 of the full Cloud Practitioner bank.
Keep going free: 10 questions per certification in bank practice, with no account.
Continue practicingRead the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.