A council training slide states: "AWS is responsible for security OF the cloud; customers are responsible for security IN the cloud." How should staff apply that framing?
Select an answer to reveal the explanation.
Short Explanation
"Of" is the building and the foundation; "in" is what you put inside and how you lock your rooms. AWS covers infrastructure security of the cloud. The city covers accounts, data, apps, and the settings it chooses in the cloud.
Full Explanation
Security of the cloud covers AWS infrastructure and facilities; security in the cloud covers customer data, identity, applications, and configurations the customer controls. That of-versus-in framing is a Cloud Practitioner staple for municipal teams: "of" is the building and foundation AWS runs; "in" is what the city puts inside and how it locks its rooms. It is incorrect to swap those meanings so that "of the cloud" means customers patch guest OS on EC2 while "in the cloud" means AWS hires facility guards. The phrases are not synonyms that erase customer IAM duties. AWS Artifact alone does not replace all customer encryption choices under "in the cloud." Distractors fail by inverting the slogan, by collapsing both sides into one blur that deletes IAM work, or by overloading Artifact as a universal encryption substitute. Exam caveat: service model still modulates exactly which OS or runtime tasks sit where, but the of/in vocabulary remains the high-level map auditors and engineers should share. Operational check: when writing municipal security plans, label controls as of-the-cloud (AWS facility and foundation) versus in-the-cloud (city IAM, data, apps, configs), then verify training materials and vendor RFPs use the same language so responsibility debates do not stall project delivery.