CAS-004 Security Architecture Practice Question
A company is migrating to a public cloud and wants to ensure they understand their security responsibilities. According to the shared responsibility model, which of the following is typically the responsibility of the cloud customer?
⚠ Common exam trap
CAS-005 often tests the misconception that the provider handles 'everything security-related,' when in fact IAM, data, and customer-side configurations always remain the customer's responsibility.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Identity and access management
Under the shared responsibility model, the cloud customer is always responsible for their own data, identities, and access management, including IAM policies, users, roles, and credentials. The provider secures the underlying infrastructure, but the customer controls who can access what within their tenant. IAM is therefore a customer responsibility across IaaS, PaaS, and SaaS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hypervisor security
Why it's wrong here
The hypervisor sits below the customer's control boundary, so the provider secures it; customers cannot patch or configure it. It is tempting because hypervisor flaws can expose guest workloads, but customer responsibility covers guest OS patching, data, identities and access configuration instead.
- ✗
Physical security of data centers
Why it's wrong here
Physical data-centre security — guards, fencing, biometric access — remains entirely with the cloud provider, never the customer. It is tempting because a breach there would compromise customer data, yet customers address it only contractually through provider certifications such as ISO 27001, not operationally.
- ✗
Network infrastructure security
Why it's wrong here
The provider owns the underlying network fabric, routers and links separating tenants, so customers do not secure that infrastructure. It is tempting because customers do configure virtual networks, security groups and firewalls within their tenancy, which is where their network responsibility actually sits.
- ✓
Identity and access management
Why this is correct
Under the shared responsibility model, the cloud customer always owns identity and access management — defining users, roles, permissions and authentication. The provider secures the underlying infrastructure, but customer identities and their access rights remain the customer's responsibility.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.