A city team assumes AWS automatically patches the guest operating system on every Amazon EC2 instance. Under the shared responsibility model, what is correct?
Select an answer to reveal the explanation.
Short Explanation
On EC2, AWS locks the building and runs the power plant; you still lock your apartment door and update your own OS. Guest OS and apps are on the customer side of the shared model. Hoping AWS silently patches every guest image is the wrong assumption.
Full Explanation
Customers are responsible for guest OS, applications, and related configuration on EC2; AWS secures the underlying cloud infrastructure. A city team assuming AWS automatically patches the guest operating system on every EC2 instance misunderstands the shared responsibility model for IaaS-style compute.
AWS does not fully patch guest OS, applications, and customer data on every EC2 instance with no customer action. Customers retain security duties on EC2; it is not a fully managed SaaS mailbox. Shared responsibility applies to EC2; billing teams alone do not own instance security.
Exam caveat: EC2 = customer owns guest OS/apps; confuse this with RDS/Lambda managed layers at your peril. Operational check: enable patch management (for example SSM Patch Manager), define maintenance windows for municipal EC2 fleets, and evidence compliance for auditors.
Municipal teams should keep a one-page decision record linking this Cloud Practitioner concept to resident outcomes, revisit it after major traffic or compliance changes, and ensure runbooks still match the chosen design.
Municipal teams should keep a one-page decision record linking this Cloud Practitioner concept to resident outcomes, revisit it after major traffic or compliance changes, and ensure runbooks still match the chosen design.