What Does "Security of the Cloud" Mean in the AWS Shared Responsibility Model?

CLF-C02 By islever Editorial Last updated

Understand the AWS shared responsibility model.

Short answer

B Security of the cloud means AWS secures the infrastructure, including hardware, software, networking, and facilities, that runs all AWS services.

Question

What does "security of the cloud” refer to in the AWS shared responsibility model?
  1. Availability of AWS services such as Amazon EC2
  2. Security of the cloud infrastructure that runs all the AWS services Correct Answer
  3. Implementation of password policies for IAM users
  4. Security of customer environments by using AWS Network Firewall partners

Key Takeaways

The question tests whether you can split AWS's duties (security OF the cloud) from the customer's duties (security IN the cloud); the trap is picking an option that is really a customer responsibility like IAM password policies or customer network security.

"Security of the cloud" is AWS's half of the shared responsibility model: AWS secures the infrastructure — hardware, software, networking, and facilities — that runs all AWS services. This page confirms that option B is the correct answer while options describing customer-side duties are not.

Common mistake: Learners often choose C (IAM password policies) or D (customer environments secured with AWS Network Firewall partners), because those sound security-related — but both describe customer-side "security in the cloud" duties, not AWS's responsibility for the underlying infrastructure.

Expert Analysis

Why the Answer Is Correct

Option B matches AWS's own wording for "security of the cloud": AWS is responsible for protecting the infrastructure that runs all of the services offered in the AWS Cloud. That infrastructure includes hardware, software, networking, and facilities such as data centers and Regions. Because AWS owns and operates the physical and virtualization layers, protecting them is AWS's job — which is exactly what option B describes. This is the AWS side of the shared responsibility model and is never delegated to customers.

Why the Other Options Are Wrong

Option A is wrong because service availability is an operational SLA and resilience concern, not the definition of the AWS security responsibility, and availability metrics such as the EC2 service level agreement are published separately. Option C describes a customer responsibility: configuring IAM password policies and managing identities are "security in the cloud" tasks performed by the customer. Option D is also customer-side, since customers secure their own environments and workloads, including using partner or native firewall solutions such as AWS Network Firewall. None of A, C, or D defines the infrastructure layer AWS itself protects.

Community Comment Notes

Every recorded vote for this question selected option B, so the community consensus lines up exactly with the official definition. Nikmah reproduces the AWS wording directly, listing "Protecting infrastructure (hardware, software, facilities, and networking) that runs all the AWS services" along with managed services like S3, DynamoDB, and RDS. ShaiTay simply echoes option B's phrasing, and CCNP21 summarizes the whole distinction as "Security of the cloud vs security in the cloud (customer)," which is the mental model the exam expects. No commenter proposed an alternative answer.

Official Reference

https://aws.amazon.com/compliance/shared-responsibility-model/

This link opens the official vendor documentation in a new tab.

Exam Strategy

Memorize the two halves as a single phrase pair: "security OF the cloud = AWS, security IN the cloud = customer." On CLF-C02, any option mentioning IAM users, passwords, customer data, customer firewalls, or customer applications is almost always the customer's side, so eliminate it when the question asks about AWS's responsibility.

Frequently Asked Questions

Why is an IAM password policy option wrong for "security of the cloud"?

IAM users, password policies, and identity management are customer responsibilities known as "security in the cloud." AWS secures the underlying infrastructure, not your identity configuration.

How do AWS Network Firewall and partner solutions fit the shared responsibility model?

They are tools customers deploy to protect their own environments and workloads — again security in the cloud. AWS's side remains protecting the global infrastructure and managed service layers.

More CLF-C02 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. Nikmah 👍 1 Answered B
    AWS responsibility - Security of the Cloud • Protecting infrastructure (hardware, software, facilities, and networking) that runs all the AWS services • Managed services like S3, DynamoDB, RDS, etc.
  2. ShaiTay 👍 1 Answered B
    B. Security of the cloud infrastructure that runs all the AWS services
  3. CCNP21 👍 1 Answered B
    Security of the cloud vs security in the cloud (customer).

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Which migration strategies move a cloud-incompatible CMS with least effort?

S-grade

Launching Third-Party IDS in AWS

S-grade

Which AWS Support Plan Offers API Access Most Cost-Effectively?

S-grade

S3 Express One Zone for Single-Digit Millisecond Latency

S-grade

Practice All CLF-C02 Questions

Access 120 questions with complete answers and detailed explanations.

View Full CLF-C02 Practice Test →

← Back to CLF-C02 Study Guide