The customer is still responsible for securing resources they create, like data and applications.

Correct!

Responsibility is divided, with the customer managing security in the cloud and the provider managing security of the cloud.

Configuration reviews are a core customer responsibility needed to secure cloud settings and network rules.

Cloud providers operate and secure the physical data centers as part of their responsibility over the cloud infrastructure.

Cloud providers secure the virtualization layers and networking hardware.

Correct!

Cloud providers maintain global connectivity and networking hardware.

Misconfigured storage buckets are a misconfiguration issue, which is addressed through regular auditing, not MFA.

Correct!

Network outages are typically infrastructure reliability issues managed by the cloud provider, unrelated to user authentication.

API rate limit failures are related to service management and API and interface attacks, not the security of an individual user's password.

Reviewing IAM logs is a necessary security practice, not a configuration mistake.

Enforcing least privilege is a strong identity practice used to reduce damage if an identity is compromised.

Correct!

Regularly rotating credentials is an essential practice for protecting credentials and preventing credential compromise.