Under the shared responsibility model, who is responsible for classifying a customer's data and deciding who may access it?
Show answer and explanation
Answer: C
Customers own their data and therefore decide how it is classified and who inside their organization may access it — those content and access decisions are squarely on the customer side of the shared responsibility model.
AWS secures the underlying cloud infrastructure and supplies tools such as Macie, KMS, and CloudTrail that customers can configure for help, but the data owner always retains the classification and authorization duty.
Why the other options are wrong
- A. The datacenter operator, AWS, secures the physical infrastructure but plays no role in classifying the content customers store in it.
- B. An external auditor evaluates evidence of controls; accountability for data classification and access rests with the data owner.
- D. The APN is a partner ecosystem and carries none of the customer's data-responsibility obligations.