Browse AWS Certification Guides

CLF-C02 Shared Responsibility and Protection Boundaries Guide

April 1, 2026

Study CLF-C02 Shared Responsibility and Protection Boundaries: key concepts, common traps, and exam decision cues.

On this page

The shared responsibility model is one of the most-tested ideas on CLF-C02 because it prevents weak assumptions. AWS secures the cloud infrastructure it operates. Customers still secure what they run in the cloud, how they configure it, who can access it, and how their data is protected.

Shared responsibility model: Security split where AWS is responsible for security of the cloud and the customer is responsible for security in the cloud.

What AWS is really testing here

The exam wants you to classify whether the responsibility belongs mainly to:

  • AWS
  • the customer
  • or a boundary that shifts depending on how managed the service is

The baseline split

AWS typically handles Customer typically handles
physical datacenters and hardware data classification and protection choices
foundational networking and host infrastructure identities, users, roles, and permissions
managed service platform layers workload configuration
hypervisor and core service availability guest OS and application controls on customer-managed compute

Managed services shift the boundary, not the duty

The customer boundary changes depending on the service model:

    flowchart LR
	  A["EC2"] --> B["Customer manages guest OS, patching, and application layer"]
	  C["RDS"] --> D["AWS manages more of the database platform layer"]
	  E["Lambda"] --> F["AWS manages even more of the runtime platform"]

What stays true:

  • AWS does not decide who should access your data
  • AWS does not remove the need for secure configuration
  • AWS does not own your least-privilege choices

Common CLF-C02 examples

Scenario Strongest interpretation
broken disk in the AWS datacenter AWS responsibility
overly broad IAM permissions customer responsibility
security group opened too widely customer responsibility
physical facility redundancy AWS responsibility
deciding whether sensitive data should be encrypted customer responsibility

Common traps

Trap Better thinking
“Managed service means AWS handles all security.” Managed service means AWS handles more of the platform, not all customer security choices.
“AWS patches the guest OS on EC2.” Guest OS and instance-level controls are still the customer’s lane on EC2.
“AWS classifies customer data automatically.” Data handling and classification remain with the customer.
“Once encryption is enabled, the responsibility question is finished.” The customer still owns access, policy, and secure usage decisions.

Sample exam question

A company stores sensitive records in AWS and uses IAM users with permissions that are broader than necessary. Which statement is strongest?

  1. AWS is responsible because the data is in the AWS Cloud
  2. AWS is responsible only if the workload uses a managed service
  3. The customer is responsible for access configuration and data protection choices, even though AWS secures the underlying infrastructure
  4. No one is responsible if encryption is enabled

Correct answer: 3

Why: AWS secures the underlying cloud platform, but the customer still owns identities, permissions, and data protection decisions.

Decision order that usually wins

  1. Ask whether the issue is about physical infrastructure, platform operation, configuration, identity, or data.
  2. If it is about datacenters, hardware, or core managed infrastructure, lean toward AWS responsibility.
  3. If it is about permissions, encryption choices, network rules, or data handling, lean toward customer responsibility.
  4. If the service is more managed, remember the boundary shifts, but data and access decisions still remain with the customer.
  5. Reject any answer that treats managed service as “AWS secures everything for us.”

Quiz

Loading quiz…
Revised on Monday, June 15, 2026
2.2 Identity, Access & Root-Account Protection