Exam Bundle

All infrastructure outsourced to customer incorrectly makes customers responsible for AWS-operated physical infrastructure. This does not address the need for An architect compares VM-managed and platform-managed offerings to understand shifting maintenance duties. The appropriate Service-dependent responsibility boundary applies because Responsibility shifts with service abstraction; moving to managed services transfers certain platform tasks to AWS.

Identical duties for all services: Ignores how shared-responsibility boundaries differ for EC2 and fully managed services. This does not address the need for An architect compares VM-managed and platform-managed offerings to understand shifting maintenance duties. The appropriate Service-dependent responsibility boundary applies because Responsibility shifts with service abstraction; moving to managed services transfers certain platform tasks to AWS.

All security outsourced to AWS incorrectly removes customer responsibility for identities, data and configurations. This does not address the need for An architect compares VM-managed and platform-managed offerings to understand shifting maintenance duties. The appropriate Service-dependent responsibility boundary applies because Responsibility shifts with service abstraction; moving to managed services transfers certain platform tasks to AWS.

Customer NACL configuration is a customer configuration responsibility for subnet-level network filtering. That does not meet the requirement: A cloud audit asks who maintains the foundational AWS network fabric between facilities.

Customer subnet policy design is a customer network architecture decision inside the VPC. That does not meet the requirement: A cloud audit asks who maintains the foundational AWS network fabric between facilities.

Customer security group changes: Control network traffic rules on customer AWS resources. That does not meet the requirement: A cloud audit asks who maintains the foundational AWS network fabric between facilities.

Customer NACL configuration is a customer configuration responsibility for subnet-level network filtering. This does not address the need for A cloud audit asks who maintains the foundational AWS network fabric between facilities. The appropriate AWS underlying network responsibility applies because AWS maintains the underlying global networking infrastructure while customers manage their logical VPC controls.

Customer security group changes: Control network traffic rules on customer AWS resources. This does not address the need for A cloud audit asks who maintains the foundational AWS network fabric between facilities. The appropriate AWS underlying network responsibility applies because AWS maintains the underlying global networking infrastructure while customers manage their logical VPC controls.

Customer subnet policy design is a customer network architecture decision inside the VPC. This does not address the need for A cloud audit asks who maintains the foundational AWS network fabric between facilities. The appropriate AWS underlying network responsibility applies because AWS maintains the underlying global networking infrastructure while customers manage their logical VPC controls.

Customer security group changes: Control network traffic rules on customer AWS resources. That does not meet the requirement: Consider this AWS requirement: A company wants to distinguish protecting AWS physical network equipment from configuring its own VPC controls.

Customer NACL configuration is a customer configuration responsibility for subnet-level network filtering. That does not meet the requirement: Consider this AWS requirement: A company wants to distinguish protecting AWS physical network equipment from configuring its own VPC controls.

Customer subnet policy design is a customer network architecture decision inside the VPC. That does not meet the requirement: Consider this AWS requirement: A company wants to distinguish protecting AWS physical network equipment from configuring its own VPC controls.

Customer subnet policy design is a customer network architecture decision inside the VPC. This does not address the need for A company wants to distinguish protecting AWS physical network equipment from configuring its own VPC controls. The appropriate AWS underlying network responsibility applies because AWS maintains the underlying global networking infrastructure while customers manage their logical VPC controls.

Customer NACL configuration is a customer configuration responsibility for subnet-level network filtering. This does not address the need for A company wants to distinguish protecting AWS physical network equipment from configuring its own VPC controls. The appropriate AWS underlying network responsibility applies because AWS maintains the underlying global networking infrastructure while customers manage their logical VPC controls.

Customer security group changes: Control network traffic rules on customer AWS resources. This does not address the need for A company wants to distinguish protecting AWS physical network equipment from configuring its own VPC controls. The appropriate AWS underlying network responsibility applies because AWS maintains the underlying global networking infrastructure while customers manage their logical VPC controls.

AWS managed hypervisor patching updates AWS-operated infrastructure components rather than customer workload configuration. That does not meet the requirement: A department creates IAM identities and must keep their passwords and access keys under customer control.

AWS building security refers to AWS responsibility for protecting the physical data-center building and its entry points. That does not meet the requirement: A department creates IAM identities and must keep their passwords and access keys under customer control.

AWS physical disk disposal is part of AWS physical media-handling responsibilities. That does not meet the requirement: A department creates IAM identities and must keep their passwords and access keys under customer control.

AWS building security refers to AWS responsibility for protecting the physical data-center building and its entry points. This does not address the need for A department creates IAM identities and must keep their passwords and access keys under customer control. The appropriate Customer IAM credential management applies because The customer controls account identities, authentication credentials and their permitted actions.

AWS physical disk disposal is part of AWS physical media-handling responsibilities. This does not address the need for A department creates IAM identities and must keep their passwords and access keys under customer control. The appropriate Customer IAM credential management applies because The customer controls account identities, authentication credentials and their permitted actions.

AWS managed hypervisor patching updates AWS-operated infrastructure components rather than customer workload configuration. This does not address the need for A department creates IAM identities and must keep their passwords and access keys under customer control. The appropriate Customer IAM credential management applies because The customer controls account identities, authentication credentials and their permitted actions.

AWS building security refers to AWS responsibility for protecting the physical data-center building and its entry points. That does not meet the requirement: A technical reviewer evaluates this need: A project manager asks who handles the credential hygiene for identities in the AWS account.

AWS physical disk disposal is part of AWS physical media-handling responsibilities. That does not meet the requirement: A technical reviewer evaluates this need: A project manager asks who handles the credential hygiene for identities in the AWS account.

AWS managed hypervisor patching updates AWS-operated infrastructure components rather than customer workload configuration. That does not meet the requirement: A technical reviewer evaluates this need: A project manager asks who handles the credential hygiene for identities in the AWS account.

AWS physical disk disposal is part of AWS physical media-handling responsibilities. This does not address the need for A project manager asks who handles the credential hygiene for identities in the AWS account. The appropriate Customer IAM credential management applies because The customer controls account identities, authentication credentials and their permitted actions.

AWS managed hypervisor patching updates AWS-operated infrastructure components rather than customer workload configuration. This does not address the need for A project manager asks who handles the credential hygiene for identities in the AWS account. The appropriate Customer IAM credential management applies because The customer controls account identities, authentication credentials and their permitted actions.

AWS building security refers to AWS responsibility for protecting the physical data-center building and its entry points. This does not address the need for A project manager asks who handles the credential hygiene for identities in the AWS account. The appropriate Customer IAM credential management applies because The customer controls account identities, authentication credentials and their permitted actions.

AWS Config: Tracks and evaluates configurations of AWS resources. That does not meet the requirement: An auditor asks for AWS third-party compliance reports and certifications relevant to cloud services.

Amazon GuardDuty: Detects suspicious activity through supported telemetry. That does not meet the requirement: An auditor asks for AWS third-party compliance reports and certifications relevant to cloud services.

AWS CloudTrail records API requests and account management events. That does not meet the requirement: An auditor asks for AWS third-party compliance reports and certifications relevant to cloud services.

AWS CloudTrail records API requests and account management events. This does not address the need for An auditor asks for AWS third-party compliance reports and certifications relevant to cloud services. The appropriate AWS Artifact applies because AWS Artifact provides on-demand AWS compliance reports and select agreements, unlike event or configuration monitoring tools.

Amazon GuardDuty: Detects suspicious activity through supported telemetry. This does not address the need for An auditor asks for AWS third-party compliance reports and certifications relevant to cloud services. The appropriate AWS Artifact applies because AWS Artifact provides on-demand AWS compliance reports and select agreements, unlike event or configuration monitoring tools.

AWS Config: Tracks and evaluates configurations of AWS resources. This does not address the need for An auditor asks for AWS third-party compliance reports and certifications relevant to cloud services. The appropriate AWS Artifact applies because AWS Artifact provides on-demand AWS compliance reports and select agreements, unlike event or configuration monitoring tools.