AWS Cloud Practitioner: Shared Responsibility Without Memorizing a Chart

This is QZ9 IT Certification Exam Prep. Today we are covering the AWS Cloud Practitioner shared responsibility model without trying to memorize a chart.

The shared responsibility model separates what AWS manages from what the customer manages. A simple way to remember it is this: AWS is responsible for security of the cloud, and the customer is responsible for security in the cloud. That phrase is useful, but practice questions require more detail.

AWS manages the physical facilities, hardware, networking infrastructure, and foundational services that operate the cloud platform. The customer manages choices made inside the account: identity and access management, data classification, encryption choices, application configuration, and network rules such as security groups.

The service type changes how much the customer manages. With Amazon EC2, the customer has more responsibility for the operating system, patches, and installed software. With managed services, AWS handles more of the underlying administration, but the customer still controls access, data, and configuration decisions.

A common exam trap is assuming AWS is responsible for everything because it is a cloud service. If a question asks who controls user permissions, password policy, exposed storage, or overly permissive access, the customer is usually responsible. If it asks about physical server replacement or data center security, that belongs to AWS.

When answering practice questions, ask two questions. Is this about the underlying cloud platform, or is it about how the customer configured and used a service? Then consider whether the service is infrastructure, platform, or managed.

QZ9 has 24 practice questions available for AWS Cloud Practitioner. You can practice AWS Cloud Practitioner questions at the QZ9 practice test page.