Under the shared responsibility model, who is responsible for encrypting company data stored in Amazon S3?
A.AWS — it manages all storage encryption
AWS secures the infrastructure; data-layer decisions belong to the customer.
B.The customer — protecting data (classification, encryption choices, access) is always 'security IN the cloud'
Correct. Data classification and encryption are squarely 'in the cloud' customer duties.
C.Both — encryption is a shared duty
The model assigns this specifically to the customer, not jointly.
D.Neither — S3 is encrypted by default so no one is responsible
Default encryption doesn't remove the customer's responsibility to configure and manage it.
Why this answer
Customers always own their data: deciding to encrypt, which mechanism, key management, and access controls. AWS provides the tools and secures the platform, but data protection is the customer's side of the model.
Correct answer: B · Last reviewed 2026-11-01
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Security Basics practice session.
Practice Security Basics