Security and Compliance: Shared Responsibility and Identity
The shared responsibility model
The single most tested idea is the split between "security of the cloud" and "security in the cloud." AWS is responsible for the physical facilities, the hypervisor, and the managed service infrastructure; the customer is responsible for data, identity configuration, patching of guest operating systems, and access control. The trap is asking who patches a managed database versus a self-managed instance on EC2. For managed services, AWS patches the engine; the customer still controls network exposure, credentials, and data classification. Another trap: encryption is not automatically "on" for every service, and key management responsibility varies by service and key store choice.
Identity and access
Understand that IAM is global and that users, groups, roles, and policies combine. Explicit deny always wins; permissions are otherwise additive; and a principal with no applicable allow is denied by default. Questions frequently probe the difference between an IAM user and a role. Roles issue temporary credentials and are the correct answer for workloads, cross-account access, and federation. Long-lived access keys on users are a red flag in any scenario. Also know that a policy attached to a role does not help unless the principal can assume that role, which requires a trust policy.
Detection, protection, and compliance
Be able to place services by purpose: network isolation and segmentation, key management, secrets storage, threat detection, configuration auditing, and traffic inspection. Compliance artifacts such as reports and attestations are obtained from the provider rather than generated by the customer, but the customer still owns evidence that its own controls operate. A common trap is assuming a service certification makes an application compliant; inheritance covers only the provider's layer.
Worked example
An application on EC2 must read from an object store. Rule of thumb: never embed keys in code or on disk. Attach an IAM role to the instance, grant the role the minimum actions on the specific resource, and let the SDK retrieve rotating temporary credentials. If a question offers access keys in environment variables, it is almost always the wrong answer.