An auditor asks which party patches the guest operating system on customer-managed EC2 instances. What is the correct interpretation of shared responsibility?

1. The customer must physically patch AWS data center networking equipment.
2. AWS patches every customer-installed guest package automatically under all EC2 configurations.
3. Using encryption transfers every security responsibility to AWS.
4. The customer manages the guest OS and workload configuration while AWS manages the underlying cloud infrastructure.