The one idea the whole security domain is built on — and the one that trips up smart people because the line moves. Seven questions, 2026 edition.
Here are 7 shared-responsibility questions in the exam's own style — free, with the answer explained, no sign-up.
Straight to the 7 free questions ↓If one idea decides your result on the CLF-C02, it is this one. The shared responsibility model runs through the entire Security and Compliance domain, and candidates who treat it as a fact to memorise struggle, while candidates who treat it as a way of thinking find that a large share of the domain answers itself. The difference is understanding that the line moves.
AWS is responsible for security of the cloud: the data centres, the hardware, the hypervisor, the host operating system, the global network. You are responsible for security in the cloud: your data, who may access it, your IAM configuration, your firewall rules, your encryption settings, your application code.
The reflex that resolves most questions is one half-sentence: if you can configure it, you own it. You can set a bucket’s permissions, so bucket access is yours. You cannot touch the hypervisor, so the hypervisor is AWS’s. Read the item, ask whether you could configure it, and the side is decided.
The mistake is imagining a single fixed boundary. There isn’t one — the split shifts with how managed the service is:
The more managed the service, the less of the stack is yours. But notice the constant: across all four, your data and your access control never leave your side. Not once, for any service. That pairing — a moving line with two things that never move — is the whole model.
Two wordings recur as wrong answers. “Split evenly between AWS and the customer” is almost always wrong, because the model assigns each specific item to exactly one party. And “AWS encrypts everything for you automatically” overstates it — AWS provides encryption tools such as KMS, but choosing and configuring encryption is yours.
Answer each one first, then read the explanation past the correct letter to why the other three fail. The distractors here are all real responsibilities placed on the wrong side of the line, or the line frozen where it should move. Being able to spot that on sight — with “if you can configure it, you own it” and “your data is always yours” — is exactly the reflex the exam is testing.
Under the shared responsibility model, which of the following is AWS's responsibility?
AWS is responsible for security *of* the cloud — the physical data centres, hardware, and the infrastructure you cannot touch. Why not the others: access to your data, your IAM permissions, and your application's accounts are all things you configure, which puts them firmly on the customer side. If you can set it, you own it.
Regardless of which AWS service is used, what is always the customer's responsibility?
Your data and access control never cross to AWS's side — on every service, for every workload, they remain yours. Why not the others: physical servers, the hypervisor and the global network are all AWS's, on every service. The exam loves this because 'always the customer's responsibility' has exactly one right answer even as everything else shifts: your data and who reaches it.
As a workload moves from Amazon EC2 to a managed service such as Amazon RDS, what happens to responsibility for patching the operating system?
The line moves with how managed the service is: on EC2 you patch the guest OS; on RDS AWS patches the OS and the database engine for you. Why not the others: it does not stay with the customer — that is the whole difference a managed service makes. It does not move the other way. And managed services are still patched; the point is that AWS does it, not that patching disappears.
A company stores sensitive data in an Amazon S3 bucket and accidentally makes it publicly readable through a misconfiguration. Whose responsibility was the exposure?
Deciding who may read a bucket is configuration, and configuration is always the customer's responsibility. Why not the others: AWS securing its infrastructure does not extend to the access settings you choose. Responsibility for a specific item is never 'split equally' — the model assigns each item to one party. And encryption at rest would not undo a public-access misconfiguration; the two are separate controls.
Who is responsible for choosing to encrypt customer data and configuring those encryption settings?
AWS provides the encryption tools, but deciding to use them and configuring them is the customer's call — encryption settings sit on your side of the line. Why not the others: AWS does not silently encrypt everything for you by default across every service. Responsibility for a given control is not split evenly. And auditors verify controls, they do not operate them.
Which of the following falls under 'security of the cloud'?
'Security of the cloud' is AWS's half — the hardware, the global network, the facilities. Why not the others: security group rules, IAM identities and application code are all things you create and configure, which makes them 'security in the cloud' and therefore yours. The preposition is the tell: *of* the cloud is AWS, *in* the cloud is you.
On which service does the customer retain the least operational responsibility — owning essentially only their data and its access?
S3 is highly managed: AWS runs all the infrastructure, and you own little beyond what you store and who may access it. Why not the others: on EC2 you also own the guest OS, patching and firewall configuration. A database you install on EC2 adds the engine to your load as well. And an on-premises server is entirely yours — the opposite end of the spectrum. The more managed the service, the less you own.
That is exactly how every question in the course works — answer, explanation, why-not. The real set continues in the practice player: 10 free questions, no sign-up.
Continue with the 10 free questions →The exam does not test whether you recognise a term — it tests whether you can rule out three plausible answers under time pressure. That is what the explanations above are for, and there are 390 more questions built exactly like them.
Collecting questions yourself
Practising with a system
Straight into the player. No account, no email.
Updated for CLF-C02 (July 2026). The sample questions above are our own work in the style of the exam — not real exam items. The exam itself is set and marked by the certification body.