A vendor tells the city council that moving workloads to AWS means the city will have zero remaining security work. Which statement correctly rejects that claim?
Select an answer to reveal the explanation.
Short Explanation
Cloud is not a magic eraser for homework. AWS secures the facilities and a lot of the underlying stack, but the city still owns accounts, data, and how apps are locked down. "Zero security work" is a sales myth the shared responsibility model flatly rejects.
Full Explanation
Moving workloads to AWS never means the city has zero remaining security work. The shared responsibility model explicitly retains customer duties for areas such as identity and access management, data classification and protection, application security, and many network and configuration controls the customer chooses. Vendor claims that AWS permanently assumes all identity, data, and application security for every customer contradict that model. AWS Artifact provides compliance reports and agreements; it does not eliminate the need for customer IAM policies or secure configuration. Security groups are useful network controls, but they do not replace identity policies or broader customer security obligations. Why the correct rejection works: foundational AWS guidance always describes a split, never a total handoff of security. Distractors fail by promising absolute AWS ownership of customer-side controls, by misusing Artifact as a magic waiver, or by treating security groups as a substitute for IAM. Exam caveat: phrases like "AWS is secure so you are done" are classic trap framing. Operational check: maintain a responsibility matrix for each civic system listing AWS-managed versus city-managed controls, and verify that onboarding vendors cannot contractually redefine that matrix into "zero customer security work."