The correct customer responsibility under the AWS Shared Responsibility Model is Configuring security groups and network settings for Amazon EC2 instances. This option is what the customer must manage within their AWS account.

The Shared Responsibility Model separates duties so that AWS handles the security of the cloud infrastructure while customers handle security in the cloud. That means Configuring security groups and network settings for Amazon EC2 instances is a customer task because customers control instance level network access rules, firewalls, and related configuration for their compute resources.

Administering the underlying servers and OS for Amazon DynamoDB is not the customer responsibility because Amazon DynamoDB is a fully managed service and AWS operates the servers and operating systems for that service.

Physical security controls in AWS data centers are managed by AWS because they secure the facilities, hardware, and physical access that run cloud services.

Securing AWS edge locations is also an AWS responsibility since edge locations and the global content delivery network are part of AWS managed infrastructure.

Full AWS Practitioner Certification Question