CAS-004 Security Architecture Practice Question
In the shared responsibility model for cloud security, which of the following is generally the responsibility of the cloud customer?
⚠ Common exam trap
CAS-005 often tests the misconception that the cloud provider secures everything once data is migrated, when in fact the customer retains responsibility for configuration, identity, and data protection layers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configuration of network access controls
In the cloud shared responsibility model, the customer is always responsible for 'security IN the cloud' — their data, configurations, and access controls. Network access control configuration (security groups, NACLs, firewall rules) is a customer-managed setting in IaaS/PaaS, so option A is correct. The provider handles 'security OF the cloud' — physical, host, and hypervisor layers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configuration of network access controls
Why this is correct
Under the shared responsibility model, the provider secures the cloud infrastructure, but customers configure their own network access controls, security groups and firewall rules. This makes network access control configuration a customer responsibility, matching the stem's question.
- ✗
Hardware maintenance of servers
Why it's wrong here
Server hardware maintenance, including disk replacement and firmware, is performed by the provider that owns the physical hosts; the customer manages only what it deploys on top. It is tempting because customers remain accountable for availability of their workloads, and hardware maintenance would be theirs where they own the servers, such as on-premises infrastructure.
- ✗
Hypervisor vulnerability patching
Why it's wrong here
The hypervisor sits beneath the customer's control boundary in IaaS and PaaS, so its patching belongs to the provider; the customer patches guest operating systems and their applications. It is tempting because virtualisation layers feel like part of the customer's estate, and hypervisor hardening would be the customer's task only in a private, self-managed cloud.
- ✗
Physical security of data centers
Why it's wrong here
Data centre physical security — perimeter controls, guards, environmental systems — remains with the cloud provider, which owns and operates the facility; the customer cannot control who enters. It is tempting because customers still classify and protect their own data, and physical security would fall to them for on-premises or colocation hosting they manage themselves.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.