Which of the following best describes the shared responsibility model in cloud security?

The shared responsibility model is a key concept in cloud security. According to the CSA Security

Guidance v4.0, Domain 1, Section 1.2.1, the responsibility for security is shared between the cloud

provider and the customer, depending on the service model (IaaS, PaaS, SaaS).

Specifically:

"Infrastructure as a Service: Just like PaaS, the provider is responsible for foundational security, while

the cloud user is responsible for everything they build on the infrastructure."

"At a high level, security responsibility maps to the degree of control any given actor has over the

architecture stack."

This means the cloud provider handles the physical security (data center, servers, etc.), while the

customer is responsible for securing the workloads they deploy on the infrastructure, such as their

applications, data, configurations, and access controls.

Incorrect Options:

B is incorrect because providers do not manage your workload or data security.

C is false – both parties share responsibilities.

D is incorrect because customers do not manage the cloud’s physical infrastructure.

Reference:

CSA Security Guidance v4.0 – Domain 1, Section 1.2.1: "Cloud Security and Compliance Scope and

Responsibilities"

CSA CCM v3.0.1 – STR-02 (Responsibility Ownership)