A county auditor asks who is responsible for hiring and managing physical security guards at AWS Region datacenters that host the city's workloads. Which answer is correct?
Select an answer to reveal the explanation.
Short Explanation
Picture a locked warehouse you rent space in — the landlord hires the night watch, not every tenant. AWS runs the physical datacenter security, including the guards. The city still secures its data and accounts, but not the Region building doors.
Full Explanation
Under the AWS shared responsibility model, physical security of Region facilities — including hiring and managing security guards, perimeter controls, and related building protections — is part of security of the cloud and therefore an AWS duty. For a county auditor reviewing who watches the doors at the datacenters that host municipal workloads, the correct framing is that AWS operates those facilities end to end. The city does not staff AWS Regions with its own contracted guards, and physical facility guarding is not framed as a fixed fifty-fifty split with every customer. Amazon GuardDuty is a managed threat-detection service for accounts and workloads; it does not supply human guards for AWS buildings. Operationally, auditors should separate facility controls (AWS) from account, identity, encryption, and application controls (customer). Exam caveat: do not confuse brand names that sound protective with physical facility staffing — GuardDuty findings and Artifact reports never replace AWS's responsibility for datacenter guards. A practical check for the municipality is to confirm that contracts and risk registers attribute Region physical security to AWS while still documenting the city's remaining duties for data classification, IAM, and workload hardening.