A midsize bank wants cloud-delivered controllers to avoid data-center hardware but must retain ownership of overlay design, security policy, and daily operations for audit compliance. The architect must explain the shared responsibility boundary before signing. Which division between Cisco-hosted and customer-managed duties describes cloud-delivered controller deployment?

Cloud-delivered deployment separates infrastructure operation from customer control, so Cisco hosts compute, provides availability, and performs software upgrades while you retain overlay configuration, policy authorship, certificate management, and monitoring. This division lets the bank avoid data-center hardware without giving up the design, security, and daily operational duties required for audit compliance. The arrangement that assigns monitoring to Cisco managed services fails because the bank explicitly needs to retain daily operations and demonstrate its own oversight. The arrangement that places security policies and templates under Cisco’s definition fails because the bank must retain ownership of its security policy rather than adopt Cisco-defined controls. The arrangement that gives the customer approval of software upgrade windows fails because Cisco owns and executes upgrades within the cloud-hosting boundary; customer approval of those windows is not part of this division. As an exam caveat, do not assume that cloud hosting means Cisco manages customer policies: hosting location and management authority are separate responsibilities. As a practical check before signing, confirm in the contract and portal roles who can configure the overlay, approve policies, renew certificates, acknowledge alarms, and schedule maintenance, and verify that audit logs attribute customer-controlled actions to customer identities.