Which statement correctly assigns responsibility for a hypervisor flaw versus an unpatched WordPress site on Amazon EC2 used by a city department?
Select an answer to reveal the explanation.
Short Explanation
Think of AWS as owning the building structure and you as owning the furniture you brought in. AWS addresses hypervisor flaws in its virtualization layer, while you patch WordPress on the EC2 guest. The city owns what it runs on the instance after launch.
Full Explanation
Hypervisor vulnerabilities are AWS's to address as part of the virtualization layer; unpatched WordPress on an EC2 guest operating system is the city's responsibility. That is the building-structure versus furniture distinction applied to a municipal website: AWS owns issues in its hypervisor, while outdated plugins and CMS packages on the guest remain a customer patching problem. The option saying both the hypervisor and WordPress plugins are exclusively the city's duty is wrong because it collapses both layers onto one party and ignores AWS's responsibility for the virtualization layer. The option saying both the hypervisor and WordPress plugins are exclusively AWS's duty on EC2 is wrong because it ignores that guest application stacks are customer-owned on EC2. The option saying the city must patch the AWS hypervisor while AWS must patch the WordPress plugins is wrong because it reverses layers. Distractors fail by reversing layers, by collapsing both layers onto one party, or by ignoring that guest application stacks are customer-owned on EC2. Exam caveat: marketplace or partner images do not remove the city's duty to maintain what it runs on the instance after launch. Operational check: subscribe guest OS and WordPress components to a patch cadence, monitor CVEs for plugins, isolate the site network-wise with security groups and private tiers where possible, take consistent backups before upgrades, and treat hypervisor concerns as AWS-managed rather than a municipal firmware project.