AWS Shared Responsibility Model: 10 practice questions

Question 1 of 10

How does the AWS shared responsibility model divide security?

1. AThe customer secures the cloud; AWS secures customer content and applications.
2. BAWS secures customer workloads; the customer secures AWS facilities.
3. CAWS and the customer jointly configure every workload security control.
4. DAWS secures the cloud; the customer secures what it operates in the cloud.

Question 2 of 10

Which item is outside the customer's physical management responsibility in AWS?

1. AThe monitoring applied to the customer's information flows
2. BThe physical servers and storage devices used by the cloud infrastructure
3. CAll application access controls selected for customer workloads across every AWS account
4. DThe network protections configured for the customer's systems

Question 3 of 10

Who retains control of security for customer content and applications running in AWS?

1. AAWS, which operates the underlying facilities
2. BThe accreditation body that certifies the AWS environment
3. CThe hardware vendor that supplies AWS storage devices
4. DThe customer that owns and operates the workload

Question 4 of 10

A team enables AWS access-control and encryption features for its application. What remains true?

1. AThe team remains responsible for choosing and applying controls to its workload.
2. BThe accreditation body now configures the workload because the features are certified.
3. CAWS becomes responsible for the application's content after those features are enabled.
4. DThe features transfer application and network security entirely to AWS operations.

Question 5 of 10

Which security benefit does a customer inherit from AWS?

1. AOwnership of the physical data centers that host customer workloads
2. BAutomatic replication of every customer resource across geographic areas
3. CA complete least-privilege permission set automatically tailored to every customer application and workload
4. DAWS policies, architecture, and operational processes that protect the infrastructure

Question 6 of 10

How should compliance be treated in an AWS architecture review?

1. AAs a third-party duty transferred to the organization issuing the accreditation
2. BAs a shared responsibility built on AWS infrastructure controls and customer controls
3. CAs an AWS-only operating duty because AWS maintains infrastructure certifications for every customer workload
4. DAs a customer-only duty because the customer owns the application content

Question 7 of 10

A review item concerns protection of traffic entering and leaving a customer application. Which side owns the control choice?

1. AThe customer, using software-based controls for its cloud resources
2. BThe auditor, because continuous AWS audits include application configuration
3. CThe storage-device manufacturer, because traffic eventually reaches storage
4. DAWS, because all traffic protection is part of physical data-center security

Question 8 of 10

A startup wants to avoid owning facilities and physical storage, but it must still control protection for its application code and network. Which responsibility map fits both constraints?

1. AThe startup manages physical storage, while AWS configures its application network.
2. BThe startup and AWS jointly operate each server and jointly configure each network rule.
3. CAWS manages the physical cloud; the startup secures its application and network.
4. DAWS manages the physical cloud and also chooses the startup's application controls.

Question 9 of 10

An audit maps two controls: data-center operations and permissions for a customer analytics platform. The map must preserve provider assurance and customer control. Which assignment is correct?

1. AAssign both controls to AWS because the platform runs on certified infrastructure.
2. BAssign data-center operations to the customer and platform permissions to AWS.
3. CAssign both controls to the customer because the customer owns the analytics data.
4. DAssign data-center operations to AWS and platform permissions to the customer.

Question 10 of 10

After an incident, a company must remediate an application access rule and verify the provider's facility safeguards without taking over hardware operations. What plan matches the model?

1. AThe company fixes the access rule and relies on AWS controls for the facilities.
2. BAWS fixes the customer access rule while the company inspects and operates the facilities.
3. CAWS fixes both areas because the workload uses AWS security features.
4. DThe company fixes both the application rule and the physical server configuration.