Exam domain 4.1 asks you to describe cloud security concepts and the shared responsibility model. This concept solves the most fundamental confusion in cloud computing: who is actually accountable for securing what? If you work through this chapter, you will understand precisely where your job as a security professional starts and stops when your company moves to the cloud, which is a guaranteed topic on the 350-701 exam.
Jump to a section
A simple way to picture Cloud Security Fundamentals
A secure apartment building is a system of shared responsibility between the landlord and the tenants. The landlord owns the building's foundation, the exterior walls, the main water pipes, and the electrical wiring that runs through the core of the building. The landlord is responsible for ensuring the front door has a strong lock, the fire alarms work, and the roofing does not leak. No single tenant can change these core structures.
Each tenant, however, is solely responsible for their own flat. The tenant chooses the deadbolt on their front door. The tenant decides whether to lock their windows before leaving for work. The tenant manages who gets a spare key to their mailbox and whether they leave their laptop visible from the street when the blinds are open. If the tenant's flat gets burgled because they left a window open, the landlord does not accept liability, even though the landlord is responsible for the security camera in the lobby.
This precise split of duties maps directly to cloud security. The cloud provider (like the landlord) secures the underlying infrastructure — the physical data centres, the network cables, and the hypervisor — while the customer (like the tenant) secures everything they put inside the cloud: their data, their user accounts, their application configurations. A tenant cannot blame the landlord for a stolen laptop any more than a cloud customer can blame the provider for a misconfigured database that leaked customer records. Understanding exactly where your responsibility ends and the provider's begins is the entire foundation of cloud security.
Cloud computing is a way of delivering IT services over the internet. Instead of a company buying its own physical servers, networking cables, and hard drives, it rents those resources from a cloud provider like Amazon Web Services (AWS), Microsoft Azure, or Google Cloud. This model is far cheaper and more flexible because you only pay for what you use, and you can scale up or down instantly.
A fundamental concept you must understand for the 350-701 exam is the shared responsibility model. This model defines who is responsible for securing each part of the cloud stack. The cloud provider is responsible for the security of the cloud, meaning the physical infrastructure, the network, and the hypervisor that virtualises the hardware. The customer is responsible for security in the cloud, meaning everything they create, configure, or store inside that infrastructure.
The exact split of responsibility changes depending on the service model you choose. There are three main service models you need to know for the exam:
Infrastructure as a Service (IaaS): You rent virtual machines, storage, and networks. The provider secures the physical data centre and the hypervisor. You are responsible for securing the operating system, the applications, the data, and your network configurations like firewalls and access control lists.
Platform as a Service (PaaS): You deploy your applications onto a platform the provider manages. The provider secures the runtime environment, the operating system, and the underlying hardware. You are responsible for your application code, the data you put into the platform, and the way you configure access to that data.
Software as a Service (SaaS): You use a fully built application like Microsoft 365 or Salesforce. The provider handles nearly everything: the application, the runtime, the operating system, and the hardware. You are only responsible for your user accounts, the data you upload, and how you configure the application's security settings like multi-factor authentication.
Another critical concept is the cloud deployment model. The exam tests three main types:
Public cloud: The provider makes resources available to anyone over the internet. Multiple customers share the same physical infrastructure, though their data is logically isolated.
Private cloud: The infrastructure is used exclusively by one organisation. It can be hosted on-premises or by a third party, but the hardware is not shared with other customers.
Hybrid cloud: A combination of public and private cloud that allows data and applications to be shared between them. This is common for organisations that need to keep sensitive data on-premises while taking advantage of the public cloud for less sensitive workloads.
There are five essential characteristics of cloud computing defined by the National Institute of Standards and Technology (NIST). You will see these tested on the exam:
On-demand self-service: Users can provision resources without human interaction with the provider.
Broad network access: Resources are available over the network and accessed through standard protocols.
Resource pooling: The provider's computing resources are pooled to serve multiple customers using a multi-tenant model.
Rapid elasticity: Resources can be scaled up and down quickly, often automatically.
Measured service: Resource usage is monitored, controlled, and reported, providing transparency for both provider and customer.
Identity and access management (IAM) is a core security function that always falls on the customer's side of the shared responsibility model. The provider gives you tools like IAM roles and policies, but you must configure them correctly. For example, you must define who can create new virtual machines, who can read data from a storage bucket, and who can delete resources. If you misconfigure an IAM policy, you can accidentally expose sensitive data to the entire internet.
Encryption is another key topic. The provider typically offers encryption at rest (protecting stored data) and encryption in transit (protecting data as it moves across the network). However, the customer must enable these features and manage the encryption keys. Some providers offer a service called a key management service (KMS) to handle this, but you still control who accesses the keys.
Finally, you must understand the concept of multi-region architecture. Cloud providers have data centres in different geographic regions (e.g., US East, Europe West, Asia Pacific). To achieve high availability and disaster recovery, you can deploy resources across multiple regions. The exam expects you to know that storing backups in a different region protects against a regional outage. However, this also means you must understand data residency laws: some countries require that certain data never leaves their borders.
Choose a Service Model
You must first decide whether to use IaaS, PaaS, or SaaS for your workload. This decision determines the boundary of your security responsibility. For example, if you choose IaaS for a database, you will be responsible for securing the operating system. If you choose PaaS, the provider handles the OS and you focus on your application code.
Select a Deployment Model
Decide between public, private, or hybrid cloud based on your compliance and security needs. A regulated industry like healthcare often uses a hybrid model to keep sensitive data on-premises while using the public cloud for less sensitive workloads. This choice affects the scope of your security controls.
Configure Identity and Access Management (IAM)
Define who can access your cloud resources and what they can do with them. Create IAM roles and policies to enforce the principle of least privilege — grant only the minimum permissions necessary. This is the single most important step because misconfigured IAM is the leading cause of cloud data breaches.
Secure the Network
Design a virtual network architecture that isolates your resources from the internet where possible. Use security groups (stateful firewalls) and network access control lists (stateless firewalls) to control inbound and outbound traffic. Place sensitive resources like databases in private subnets with no direct internet access.
Enable Encryption and Key Management
Turn on encryption at rest for all storage services (like databases and file storage) and encryption in transit for all network connections (using TLS). Set up a key management service to store and rotate encryption keys. Restrict access to the keys using IAM policies so only authorised services and users can decrypt data.
Set Up Logging and Monitoring
Enable cloud logging to capture all API calls, resource changes, and access attempts. Configure alerts for suspicious activity, such as a login from an unusual location or a sudden spike in data transfer. Regularly review logs and use automated tools to detect misconfigurations and vulnerabilities.
Implement Disaster Recovery
Design a disaster recovery plan that includes automated backups stored in a different geographic region. Set up failover mechanisms so that if the primary region goes offline, traffic is redirected to a secondary region. Test this plan regularly to ensure it works and meets your recovery time objectives.
Sarah is a security engineer at a mid-sized retail company that is migrating its customer database to a public cloud. Her manager has asked her to ensure the database is secure. Sarah must understand exactly where her company's responsibility ends and the cloud provider's responsibility begins.
First, Sarah selects a cloud provider and chooses the IaaS model because the company needs full control over the database software. The provider is responsible for securing the physical data centre, the network cables, the power supply, and the hypervisor. If a fire destroys the data centre, that is the provider's problem, not Sarah's.
Sarah must then configure a virtual machine (VM) to host the database. She must harden the operating system by applying security patches, disabling unnecessary services, and configuring a host-based firewall. The provider does not do this for her. If an attacker exploits an unpatched vulnerability in the operating system, that is Sarah's responsibility.
Next, Sarah must configure network security. She creates a virtual private cloud (VPC) with a public subnet and a private subnet. She places the database VM in the private subnet so it has no direct access to the internet. She uses a security group (a stateful firewall) to allow traffic only from the company's application servers. If she accidentally makes the database public, customer data could be exposed, and that is her mistake.
Sarah also sets up identity and access management. She creates an IAM role that allows the application server to read from the database but not delete it. She enforces multi-factor authentication for all administrative users. She also rotates access keys every 90 days. If an employee's credentials are compromised because Sarah did not enforce MFA, that is on her.
For data protection, Sarah enables encryption at rest using the provider's key management service. She also enables encryption in transit by requiring TLS for all connections to the database. She stores encryption keys in the KMS and restricts access to them using policies. If she deletes the encryption keys accidentally, the data becomes permanently inaccessible, and the provider cannot recover it.
Finally, Sarah configures logging and monitoring. She enables cloud logging to capture all API calls and database queries. She sets up alerts for suspicious activity, such as an unexpected login from a foreign IP address. She also performs regular security assessments using the provider's vulnerability scanning tools.
In practice, an IT professional like Sarah must constantly ask one question: 'Is this my job or the provider's job?' The answer determines where she spends her time, how she allocates her budget, and what she includes in her incident response plan. The 350-701 exam tests this exact decision-making process.
The 350-701 exam tests your understanding of the shared responsibility model very directly. Expect multiple-choice questions that describe a scenario and ask who is responsible for a specific security task. The trap is that beginners often assume the provider is responsible for everything, or that the customer is responsible for nothing. The correct answer always depends on the service model (IaaS, PaaS, or SaaS) and the specific layer of the stack.
The exam loves to test the following specific concepts:
For an IaaS scenario, the customer is responsible for securing the operating system, applications, and data. The provider is responsible for the physical infrastructure and the hypervisor. A common trap question describes a vulnerability in the hypervisor and asks who must patch it. The answer is always the provider.
For a PaaS scenario, the customer is responsible for the application code and the data. The provider is responsible for the runtime environment and the underlying platform. A trap question might describe a SQL injection vulnerability in the customer's application and ask if the provider should fix it. The answer is no, because the customer controls the code.
For a SaaS scenario, the customer is responsible only for user accounts, data, and application configuration. The provider is responsible for everything else. A trap question might ask who is responsible if a user's account is compromised because they used a weak password — that is always the customer's fault.
Another heavily tested area is the distinction between security of the cloud and security in the cloud. The exam will give you a list of tasks (e.g., patch physical servers, configure firewall rules, manage encryption keys, secure the data centre perimeter) and ask which ones belong to the provider and which belong to the customer. Memorise this split: physical security, hypervisor security, and network infrastructure security are the provider's domain. Data security, identity and access management, and application security are the customer's domain. \ \
The exam also tests the five NIST essential characteristics of cloud computing. Expect a question that lists four characteristics and asks which one is the correct definition. The trap is confusing 'resource pooling' with 'rapid elasticity'. Resource pooling means multiple customers share physical hardware. Rapid elasticity means you can automatically scale resources up and down. \ \
Finally, the exam tests cloud deployment models. A common scenario is a bank that must keep its customer data on-premises for compliance reasons but wants to use the public cloud for analytics. The correct answer is a hybrid cloud. The trap is choosing 'private cloud' because the bank has compliance requirements, but the question's wording indicates they want to use the public cloud for some workloads, which makes hybrid cloud the correct choice. \ \
Exam-specific terminology to memorise:
'Multi-tenancy': Multiple customers sharing the same physical resources while maintaining logical separation. The provider ensures that one customer cannot access another customer's data.
'Data sovereignty': The legal requirement that data must remain within the geographic borders of a specific country. This affects where you deploy your cloud resources.
'CSP' (Cloud Service Provider): The company that provides cloud services, such as AWS, Azure, or Google Cloud.
'Hypervisor': The software layer that virtualises the physical hardware and allows multiple virtual machines to run on a single physical server. The provider secures the hypervisor in IaaS models.
'API security': Application Programming Interface security. Cloud resources are managed through APIs, and these APIs must be secured with authentication, authorisation, and rate limiting. The customer is responsible for securing the APIs they expose.
The 350-701 exam will also test your understanding of the difference between a single-region and multi-region architecture. A question might describe a company that wants to ensure its application remains available if an entire data centre goes offline. The correct answer is to deploy resources in multiple regions with a load balancer. The trap is suggesting a single-region deployment with redundant availability zones, which protects against a single server failure but not an entire regional outage.
The shared responsibility model splits security duties between the cloud provider and the customer based on the service model (IaaS, PaaS, or SaaS).
The provider is responsible for the security of the cloud (physical data centres, network infrastructure, and hypervisor).
The customer is always responsible for their data, user identities, and the configuration of access controls.
In IaaS, the customer secures the operating system and applications; in PaaS, only the application code and data; in SaaS, only data and user accounts.
The five NIST essential characteristics of cloud computing are on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service.
Data sovereignty laws may restrict where you can store data geographically, so multi-region architecture must account for legal requirements.
Encryption at rest and in transit is available from the provider, but the customer must enable it and manage the encryption keys.
Public cloud uses multi-tenancy with logical isolation; the risk of other tenants accessing your data is negligible compared to the risk of your own misconfigurations.
Identity and access management (IAM) is a customer responsibility and is the most common source of cloud security breaches.
These come up on the exam all the time. Here's how to tell them apart.
Infrastructure as a Service (IaaS)
Customer secures the operating system of their virtual machines
Customer manages network configurations like firewalls and subnets
Customer patches their own applications and runtime libraries
Platform as a Service (PaaS)
Provider secures the underlying operating system and runtime environment
Provider manages the underlying network infrastructure
Customer only secures their application code and data
Security of the Cloud
Provider is responsible for physical data centre security
Provider manages hypervisor and network infrastructure patching
Includes compliance certifications for the provider's facilities
Security in the Cloud
Customer is responsible for data encryption and key management
Customer manages identity and access policies for their resources
Includes application security and network configuration within the customer's virtual environment
Public Cloud
Infrastructure is shared across multiple organisations using multi-tenancy
Lower cost due to economies of scale
Must rely on logical isolation for security
Private Cloud
Infrastructure is dedicated to a single organisation
Higher cost but offers physical isolation
Customer has full control over the hardware and network
Single-Region Architecture
All resources deployed in one geographic region
Lower latency for local users but vulnerable to regional outages
Simpler to manage and less expensive
Multi-Region Architecture
Resources deployed across multiple geographic regions
High availability and disaster recovery against regional failures
More complex to manage and higher data transfer costs
Mistake
The cloud provider is responsible for all security because they own the hardware.
Correct
The provider is responsible only for the security of the cloud (physical infrastructure, network, and hypervisor). The customer is responsible for security in the cloud (data, identities, configurations, and applications).
This mistake is common because people think 'renting' means the landlord handles everything, much like renting an apartment. But renting cloud infrastructure is more like renting an empty house where you must install your own locks and alarm system.
Mistake
Data encryption means the provider cannot read my data, so I do not need to worry about access controls.
Correct
Encryption protects data from unauthorised access during transmission and at rest, but it does not protect against authorised users who misuse their access. You must still enforce identity and access management (IAM) policies and the principle of least privilege.
People overestimate encryption because it sounds like a magic shield. In reality, encryption is just one layer; the keys that unlock the data are controlled by IAM, and if a user with legitimate access steals the data, encryption does not stop them.
Mistake
The shared responsibility model is the same for every cloud service model.
Correct
The model changes significantly depending on whether you use IaaS, PaaS, or SaaS. In IaaS, you handle the operating system and applications. In PaaS, the provider handles the runtime. In SaaS, the provider handles nearly everything except your data and user accounts.
Beginners often think 'the cloud' is one single thing. In reality, the three service models shift the responsibility boundary up or down the stack, and the exam specifically tests your understanding of these differences.
Mistake
If I use a public cloud, my data is not secure because other tenants share the same hardware.
Correct
Public cloud providers use strong logical isolation mechanisms such as hypervisors, virtual LANs, and encryption to ensure tenants cannot access each other's data. The risk is not from other tenants but from misconfigured services, weak passwords, or overly permissive IAM policies set by the customer.
The word 'public' sounds insecure to people unfamiliar with cloud architecture. They imagine a shared locker room where anyone can open anyone else's locker. In reality, each tenant's data is isolated by software controls that are rigorously tested and monitored.
Mistake
Moving to the cloud eliminates the need for a disaster recovery plan.
Correct
The cloud provides tools for disaster recovery, such as multi-region replication and automated backups, but the customer must still design and implement the disaster recovery strategy. The provider does not automatically protect you from a regional outage if you only deploy resources in a single region.
People assume cloud providers are invincible. Providers do have impressive redundancy, but a customer who deploys everything in one availability zone will still lose access if that zone fails. The responsibility for designing resilience is on the customer.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
The shared responsibility model defines which security tasks are handled by the cloud provider and which are handled by the customer. The provider secures the physical infrastructure and the hypervisor, while the customer secures their data, identities, and configurations. The exact split depends on whether you use IaaS, PaaS, or SaaS.
In IaaS, the customer is responsible for patching the operating system of their virtual machines. The provider patches the underlying hypervisor but does not have access to the customer's VM to install OS updates.
Your data is safe if you configure your security correctly. The provider uses strong logical isolation to separate tenants, so other customers cannot access your data. The real risk comes from your own misconfigurations, such as leaving a storage bucket publicly accessible or using weak passwords.
IaaS provides virtual machines, storage, and networks that you manage yourself. PaaS provides a platform where you deploy your own code and the provider manages the runtime. SaaS provides a fully built application that you use through a web browser, with the provider managing almost everything.
Multi-tenancy is a model where multiple customers share the same physical hardware and resources, but their data and workloads are logically isolated using software controls like hypervisors and virtual networks. It is how public cloud providers achieve economies of scale.
'Security of the cloud' refers to the measures the provider takes to protect the underlying infrastructure, such as physical data centre security and hypervisor patching. 'Security in the cloud' refers to what the customer does to protect their own resources, such as configuring firewalls, managing identities, and encrypting data.
Yes. The cloud provides the tools for disaster recovery, but you must design and implement the plan yourself. If you only deploy resources in a single region, a regional outage will still affect you. You must actively choose multi-region deployment and automated backups to achieve resilience.
You've finished Cloud Security Fundamentals. Continue through the 350-701 study guide to build a complete picture of the exam.
Done with this chapter?