Explain the 'shared responsibility model' for cloud services.

• A. The provider secures the cloud infrastructure; the customer secures data, access, and configurations in the cloud.
• B. The provider handles all security responsibilities; customer has none.
• C. The customer handles the infrastructure security; provider handles data security only.
• D. Security is not shared; only compliance matters.

Answer: (A)

The shared responsibility model means security duties are divided between the cloud provider and the customer. The provider is responsible for securing the underlying cloud infrastructure—hardware, networking, data centers, virtualization, and the foundational services that run the cloud. The customer is responsible for security “in the cloud”—their data, access controls, identity management, encryption choices, configurations, and the applications and data they run or store in the cloud.

This division stays consistent across service models, though the exact split shifts a bit: with IaaS the customer handles most of the guest OS, middleware, and applications, while the provider secures the infrastructure; with PaaS the provider takes on more of the stack, and with SaaS the provider handles most of it, leaving the customer mainly responsible for data and user access. The essential point is that both parties have security responsibilities, and the customer must actively manage data, access, and configuration in the cloud.

So the best description is that the provider secures the cloud infrastructure, while the customer secures data, access, and configurations in the cloud. The idea that the provider handles everything or that security isn’t shared doesn’t reflect how cloud security responsibilities are actually divided.