Free AWS Cloud Practitioner CLF-C02 Practice Question

While AWS manages the infrastructure and ensures the security of the hardware, software, networking, and facilities that run AWS Cloud services, the encryption of data at rest is a customer responsibility. AWS offers the tools and services (like Amazon S3 server-side encryption), but it is up to the customer to configure and manage these features according to their security requirements. Therefore, the answer suggesting that AWS is responsible for data encryption at rest is incorrect. It is a shared control: AWS provides the capability, while the customer must configure and enable it.

For more information, see the Shared Responsibility Model in the AWS documentation which states file and data encryption is the responsibility of the customer.