AWS operates, secures, and maintains the underlying facilities, hardware, and global network and The customer configures encryption, identity and access management, and application-layer protections are correct because they describe the split where AWS is responsible for the underlying infrastructure and the customer is responsible for configuring and protecting their data and applications.

AWS operates, secures, and maintains the underlying facilities, hardware, and global network covers physical data center security, server hardware lifecycle, and global network integrity. AWS manages the host infrastructure, isolation of the virtualization layer, and the foundational services so customers do not need to provide physical or low level hardware controls.

The customer configures encryption, identity and access management, and application-layer protections means the customer must manage IAM policies and roles, choose and configure encryption and key management, secure guest operating systems when applicable, and implement application level controls and monitoring required for compliance and audits.

AWS defines and enforces the customer’s internal compliance policies and control procedures is incorrect because AWS supplies compliant services and documentation but it is the customer who must define, implement, and operate their internal governance and control procedures to meet regulatory requirements.

AWS automatically performs application-level backups of each customer’s data without customer configuration is incorrect because backup responsibilities and retention settings depend on the service and the customer must configure and manage application level backups and recovery processes.

The customer must provide physical security for AWS data center buildings and server rooms is incorrect because AWS is responsible for physical security of its data centers and customers do not provide or manage those controls.

Full AWS Practitioner Certification Question