1.4 - The shared responsibility model
Cloud+ CV0-004 objective 1.4 covers the shared responsibility model, which splits security duties between provider and customer. The split depends on the service model. Under IaaS, the customer is responsible for patching the guest operating system, since the provider only secures the physical infrastructure and hypervisor. Under PaaS, the customer remains responsible for the application and data, while the provider handles the OS and runtime. Under SaaS, the provider runs almost everything, but managing user access - accounts and permissions - always remains the customer's job. As you move from IaaS toward SaaS, the customer's share of responsibility shrinks steadily. The provider is always responsible for the security of the cloud; the customer for security in the cloud. Expect scenario questions that name a task and a service model and ask who is responsible.
IaaS: customer patches the guest OS. PaaS: customer owns app + data. SaaS: customer still manages user access. Toward SaaS = customer share shrinks. Provider = security OF the cloud; customer = security IN the cloud.
Practice questions
1. Under the shared responsibility model for IaaS, who is responsible for patching the guest operating system?
- The provider
- The customer (correct answer)
- Neither party
- The auditor
In IaaS the customer manages the guest OS and above (patching, apps, data). The provider secures the physical hosts, network and hypervisor.
2. Under the shared responsibility model for SaaS, which task remains the customer's job?
- Patching the servers
- Securing the datacenter
- Managing user access (correct answer)
- Maintaining the runtime
Even in SaaS the customer still owns their data and identity: user accounts, access rights and data classification. The provider handles the app, runtime and infrastructure.
3. Moving from IaaS toward SaaS, how does the customer's share of the shared responsibility change?
- It shrinks steadily (correct answer)
- It grows steadily
- It stays fixed
- It disappears entirely
As you move IaaS to PaaS to SaaS the provider assumes more layers, so the customer's responsibility shrinks but never vanishes: data and identity always stay yours.
4. In the PaaS model, which layer does the customer remain responsible for?
- The operating system
- The application and data (correct answer)
- The runtime engine
- The physical network
In PaaS the provider runs the OS, runtime and middleware, so the customer is responsible for their own application code and data. IaaS would also make the OS the customer's job.
5. Across all cloud service models, which responsibility never shifts to the provider?
- Data classification (correct answer)
- OS patching
- Hypervisor upkeep
- Physical security
Data classification and access decisions always remain the customer's duty, even in SaaS, because only the customer knows the data's sensitivity. Physical and hypervisor tasks are the provider's.
6. A SaaS provider isolates each customer's data with a separate schema while sharing the app tier. This tenancy model is:
- Single-tenant
- Dedicated hosting
- Multitenancy (correct answer)
- Colocation
Multitenancy shares application infrastructure among customers while logically isolating each tenant's data. Single-tenant would give each customer fully separate infrastructure.