Explanation

Under the AWS Shared Responsibility Model:

• Amazon EC2 operating system patching (B) - This is the customer's responsibility. AWS manages the underlying infrastructure, but customers are responsible for patching the operating systems and applications running on their EC2 instances.

• API access control for AWS resources (C) - This is the customer's responsibility. Customers must manage IAM policies, user access, and API permissions for their AWS resources.

Why other options are NOT customer responsibilities:

• Hardware maintenance (A) - AWS responsibility
• Configuration management of infrastructure devices (D) - AWS responsibility (AWS manages the physical infrastructure)
• Maintenance of an Availability Zone (E) - AWS responsibility

In the shared responsibility model, AWS is responsible for security OF the cloud (infrastructure), while customers are responsible for security IN the cloud (their data, applications, operating systems, etc.).