An organization is migrating workloads to an infrastructure as a service (IaaS) provider. A business sponsor believes the provider will now be responsible for all security. Under the shared responsibility model, which responsibility remains with the organization?
Select an answer to reveal the explanation.
Short Explanation
Renting an apartment means the landlord fixes the roof, but locking your own door and guarding your valuables is still on you. In IaaS the provider runs the building; you run everything you put inside it. The trap is believing that moving to the cloud moves all the security work too.
Full Explanation
The shared responsibility model divides security duties according to the service model. In infrastructure as a service, the provider secures the physical facilities, hardware, network fabric and virtualization layer, while the customer remains responsible for what it builds and runs on that infrastructure: guest operating systems, applications, configuration, identity and access management, and the protection of its data. Accountability for the data never transfers, whatever the service model. Physical security of data centers and hardware sits with the provider, because the customer has no access to or control over the facilities. The hypervisor is part of the virtualization layer the provider operates and patches; customers cannot manage it in an IaaS offering. Power, cooling and facility networking are likewise provider responsibilities covered by its own operational controls and assurance reports. The sponsor's belief is a common misconception that leads to misconfigured storage, excessive permissions and unprotected data. Exam caveat: the split shifts toward the provider in platform and software services, so read the service model in each question before assigning duties. Operational check: produce a responsibility matrix for the migrated workloads that names an internal owner for configuration, identity, data protection and monitoring, and confirm these are covered in the security program.