What Does "Security of the Cloud" Mean in the AWS Shared Responsibility Model?

Why the Answer Is Correct

Option B matches AWS's own wording for "security of the cloud": AWS is responsible for protecting the infrastructure that runs all of the services offered in the AWS Cloud. That infrastructure includes hardware, software, networking, and facilities such as data centers and Regions. Because AWS owns and operates the physical and virtualization layers, protecting them is AWS's job — which is exactly what option B describes. This is the AWS side of the shared responsibility model and is never delegated to customers.

Why the Other Options Are Wrong

Option A is wrong because service availability is an operational SLA and resilience concern, not the definition of the AWS security responsibility, and availability metrics such as the EC2 service level agreement are published separately. Option C describes a customer responsibility: configuring IAM password policies and managing identities are "security in the cloud" tasks performed by the customer. Option D is also customer-side, since customers secure their own environments and workloads, including using partner or native firewall solutions such as AWS Network Firewall. None of A, C, or D defines the infrastructure layer AWS itself protects.

Community Comment Notes

Every recorded vote for this question selected option B, so the community consensus lines up exactly with the official definition. Nikmah reproduces the AWS wording directly, listing "Protecting infrastructure (hardware, software, facilities, and networking) that runs all the AWS services" along with managed services like S3, DynamoDB, and RDS. ShaiTay simply echoes option B's phrasing, and CCNP21 summarizes the whole distinction as "Security of the cloud vs security in the cloud (customer)," which is the mental model the exam expects. No commenter proposed an alternative answer.