Shared responsibility model in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding the Shared Responsibility Model

In cloud computing, the shared responsibility model divides security duties between the cloud provider and the customer. Which of the following best describes the customer's responsibility?

A Configuring and managing the security settings of the applications and data they deploy on the cloud.

B Maintaining the hardware and software infrastructure of the cloud platform.

C Managing the physical security of the data centers where cloud servers are located.

D Ensuring the cloud provider complies with government regulations.

💡 Hint

Think about what the customer controls directly in the cloud environment.

The cloud provider manages the physical infrastructure and platform security, while the customer is responsible for securing their own data, applications, and configurations within the cloud.

📋 Factual

intermediate

Identifying Cloud Provider Responsibilities

Which of the following is a responsibility of the cloud service provider in the shared responsibility model?

A Setting up user access controls for customer applications.

B Encrypting customer data before uploading it to the cloud storage.

C Providing and maintaining the physical servers and network infrastructure.

D Monitoring the customer's application logs for suspicious activity.

💡 Hint

Consider what the cloud provider owns and operates physically.

The cloud provider is responsible for the physical infrastructure such as servers, storage, and networking equipment. Customers handle data encryption and access controls.

🔍 Analysis

advanced

Analyzing Security Failures in Shared Responsibility

A company using cloud services suffered a data breach because their cloud storage was left publicly accessible. According to the shared responsibility model, who is primarily at fault?

A The third-party software vendor used by the customer.

B The cloud provider, for not securing the storage infrastructure properly.

C Both the cloud provider and the customer equally share the blame.

D The customer, for misconfiguring the access permissions of their storage resources.

💡 Hint

Think about who controls access settings for cloud storage.

The cloud provider secures the infrastructure, but customers are responsible for configuring access controls. Leaving storage publicly accessible is a customer misconfiguration.

❓ Comparison

advanced

Comparing Responsibility in IaaS vs SaaS Models

In the shared responsibility model, how does the customer's security responsibility differ between Infrastructure as a Service (IaaS) and Software as a Service (SaaS)?

A In IaaS, the customer manages the operating system and applications; in SaaS, the customer only manages data and user access.

B In SaaS, the customer manages the physical servers; in IaaS, the provider manages all software layers.

C In both IaaS and SaaS, the customer is responsible for hardware maintenance.

D In IaaS, the provider manages user access; in SaaS, the customer manages network security.

💡 Hint

Consider which layers the customer controls in each service model.

In IaaS, customers manage OS, middleware, and applications. In SaaS, the provider manages everything except customer data and user access.

❓ Reasoning

expert

Determining Responsibility for Compliance in Cloud Environments

A healthcare company uses a cloud provider to store patient records. According to the shared responsibility model, who is responsible for ensuring compliance with healthcare data protection laws like HIPAA?

A The cloud provider alone, because they control the infrastructure.

B Both the cloud provider and the customer share responsibility for compliance.

C The customer alone, because they own the data and must comply with laws.

D Neither, compliance is handled by government agencies.

💡 Hint

Think about how compliance involves both infrastructure and data handling.

Compliance requires the cloud provider to secure infrastructure and the customer to manage data properly. Both must work together to meet legal requirements.