An auditor asks whether shared responsibility means a fixed 50/50 split between Microsoft and the city. Which statement is accurate?
Select an answer to reveal the explanation.
Short Explanation
It is not a pizza cut down the middle forever. Move from VMs to PaaS to SaaS and Microsoft picks up more of the stack. The city's leftover slice changes with the service type.
Full Explanation
Shared responsibility is not a fixed fifty-fifty contract. The split shifts with service type: IaaS leaves more of the stack with the customer, PaaS moves more platform responsibility to the provider, and SaaS moves still more application infrastructure to the provider while customers retain data and access duties. Auditors should evaluate controls against the actual service model, not a permanent percentage.
Insisting Azure contracts always assign exactly half of every control to each party invents a numeric rule the model does not use. Treating shared responsibility as a permanent 50/50 split that never changes by workload ignores IaaS/PaaS/SaaS differences. Scoring every control as half customer and half Microsoft regardless of service produces meaningless audit results.
Exam caveat: even within one subscription, different resources can sit at different layers of the shared model at the same time. Operational check: for each in-scope workload, label it IaaS, PaaS, or SaaS and maintain a control matrix that shows which party patches OS, manages runtime, configures the app, and governs identities and data. When the auditor asks for a percentage, answer with a layer diagram instead: physical and host layers trend toward Microsoft in public cloud, while data and access stay with the city across IaaS, PaaS, and SaaS even as middle layers move.