ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

In the AWS shared responsibility model, customers are responsible for everything they install and run inside each EC2 instance, including guest operating-system hardening, host-based firewalls, and any IAM policies that govern access to their own resources. AWS, however, retains responsibility for protecting and maintaining the underlying cloud infrastructure that supports those instances-this includes managing and applying security patches to the hypervisor and its supporting host hardware. Therefore, ensuring the hypervisor is up to date and free from known vulnerabilities is an AWS obligation, not the customer's. Configuring iptables inside the instance, keeping the guest OS current, or defining IAM policies all remain customer duties.