CAS-004 Security Architecture Practice Question
A company is migrating its workloads to a public cloud and wants to ensure it understands the division of security responsibilities. Which model defines the demarcation of security controls between the cloud provider and the customer?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Shared responsibility model
The shared responsibility model clearly delineates which security tasks are handled by the cloud provider and which by the customer, varying by service type (IaaS, PaaS, SaaS).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud Security Posture Management (CSPM)
Why it's wrong here
CSPM continuously assesses cloud configurations against benchmarks and compliance baselines; it does not define which party owns which control. It is tempting because both address cloud security governance, but CSPM is correct when the requirement is detecting misconfigurations and drift, not establishing responsibility boundaries.
- ✗
Zero trust architecture
Why it's wrong here
Zero trust architecture governs access decisions through identity verification and least privilege; it does not allocate security ownership between provider and customer. It is tempting because both concern cloud security design, but zero trust is correct when the requirement is removing implicit network trust, not documenting the shared responsibility split.
- ✗
Cloud Access Security Broker (CASB)
Why it's wrong here
A CASB enforces policy between users and cloud services, discovering shadow IT and controlling data flows; it does not define provider-versus-customer control boundaries. That demarcation is the shared responsibility model. A CASB would be correct when an organisation needs visibility and governance over sanctioned and unsanctioned SaaS usage.
- ✓
Shared responsibility model
Why this is correct
The shared responsibility model divides security controls along the cloud service model's boundary: the provider secures the physical hosts, network and hypervisor up to the layer it operates, while the customer secures what they configure, such as data, identities and access policies. This directly answers the stem's need to understand the demarcation of controls between provider and customer.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.