A municipal auditor asks who patches the guest operating system on Amazon EC2 instances versus who secures the AWS data centers. Which statement correctly applies the shared responsibility model?
Select an answer to reveal the explanation.
Short Explanation
On EC2, you still own the guest OS like you own the software inside a rented apartment—AWS owns the building and the locks on the street. Patch the OS and apps yourself; leave the data center perimeter to AWS. That split is the shared responsibility model at IaaS depth.
Full Explanation
Under the AWS shared responsibility model for Amazon EC2 (IaaS), the customer is responsible for the guest operating system, installed applications, security groups and network configuration they control, IAM, and data—while AWS is responsible for security of the cloud: facilities, hardware, hypervisor, and the global infrastructure. A municipal auditor asking who patches the guest OS versus who secures data centers should hear that split clearly: city administrators patch and harden AMIs and instances; AWS patches and operates the physical and virtualization layers. That is why CIS benchmarks and patch manager practices still matter on EC2.
Claiming AWS patches every guest OS on customer EC2 instances reverses responsibility; AWS does not log into your instances to apply Windows or Linux patches. Claiming the city secures AWS global data centers is equally wrong—physical facilities are AWS's domain. Saying shared responsibility means neither party patches anything is a misunderstanding; responsibility is shared by layer, not abandoned.
Exam caveat: managed services shift more responsibility to AWS (for example RDS patching of the engine), but EC2 remains customer-heavy on the guest. Abstraction level changes the line—know where your service sits. Operational check: document an EC2 patch cadence (SSM Patch Manager or golden AMIs), verify security groups and IAM instance roles are customer-controlled, and map auditor questions to the official shared responsibility diagram so answers stay consistent across services.