In a shared security responsibility model for IaaS, which two layers of the stack does the customer share responsibility for? (Choose two.)

In the shared responsibility model for IaaS, security is a partnership. The cloud provider is responsible for the security of the cloud, while the customer is responsible for security in the cloud. Network Security and Access Policies are classic examples of shared responsibility. Google secures the global network infrastructure, but the customer is responsible for configuring Virtual Private Cloud (VPC) networks, firewall rules, and other network controls. Similarly, Google provides the Identity and Access Management (IAM) framework, but the customer is responsible for defining and managing the access policies (who has access to what).

Hardware security is the exclusive responsibility of the cloud provider. The customer has no physical access to or control over the underlying hardware. Storage Encryption has a shared component, but Google encrypts all data at rest by default, making the provider's role dominant. The customer's primary role is optional key management. Boot security is shared (provider secures host boot, customer secures guest boot via Shielded VM), but Network Security and Access Policies represent more fundamental and mandatory areas of customer configuration.

1. Google Cloud Security Foundations Guide v2.0, Page 11, "Figure 1: Shared security model in the cloud". This diagram explicitly places "Network controls" and "Access rights" in the "Shared Responsibility" column.

2. Google Cloud Blog, "Shared responsibility and shared fate: How we work with customers to secure their workloads". This article discusses how customers are responsible for "configuring network security controls like cloud firewalls" and "managing access control with Cloud IAM."

3. Google Cloud Documentation, "Overview of Google Cloud security". This document states, "You are responsible for things that you put on the cloud... This includes managing... access policies, and your firewall rules."