An auditor asks whether shared responsibility with a cloud provider is always a fixed 50/50 split. Which statement is accurate for CompTIA Cloud+ service models?
Select an answer to reveal the explanation.
Short Explanation
Shared responsibility is not a coin flip down the middle—it moves like a sliding scale. On IaaS you still babysit a lot of the stack; on SaaS the provider runs more of it. Auditors looking for a fixed 50/50 miss how the model itself changes the line.
Full Explanation
Cloud shared responsibility is not a universal fifty-percent split; the boundary moves with the service model. Customers generally own more of the stack—guest OS, middleware, and applications—on Infrastructure as a Service, while providers absorb more layers on Platform as a Service and especially Software as a Service. Auditors asking for a fixed 50/50 division misunderstand how CompTIA Cloud+ frames control ownership. Identical fifty-percent divisions across IaaS, PaaS, and SaaS contracts do not exist as a standard rule. Providers do not always own exactly half of identity management regardless of model; identity is frequently a shared or customer-heavy control, especially for directories and role assignments. Customers never own the public cloud hypervisor while somehow owning zero application security—that pairing reverses both sides of the model. Exam caveat: when a stem mentions “shared responsibility,” map duties to IaaS versus PaaS versus SaaS rather than inventing a percentage. Operational check: for each municipal subscription, attach the provider’s shared-responsibility matrix to the system security plan, list customer-owned controls explicitly, and verify evidence (patch reports, IAM reviews, encryption settings) matches the service model in use.