SY0-701 Security Architecture Practice Question
A team is moving an application to a cloud provider. The cloud provider will secure the physical data center and core infrastructure, while the company must still secure its own application settings and user access. What concept does this describe?
⚠ Common exam trap
Many exam-takers confuse the shared responsibility model with a simple 'provider does everything' or 'customer does everything' approach, failing to recognize that security obligations are split based on the service model (IaaS, PaaS, SaaS) and that the customer always retains responsibility for data and access management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Shared responsibility model
The shared responsibility model defines the division of security obligations between a cloud provider and its customer. In this scenario, the provider secures the physical data center and core infrastructure (the 'security of the cloud'), while the company retains responsibility for application settings and user access (the 'security in the cloud'). This model is foundational to all major cloud providers, including AWS, Azure, and Google Cloud.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Fail-open design
Why it's wrong here
Fail-open describes a security control's behavior during a failure, such as an authentication service crashing and defaulting to allow access to maintain availability. While this is a legitimate availability-versus-security trade-off, it has no bearing on how cloud security responsibilities are contractually and operationally divided between the provider and the customer. Thus, it fails to explain the scenario of moving an application to a cloud provider.
- ✓
Shared responsibility model
Why this is correct
The shared responsibility model is the framework that defines how cloud security duties are split: the provider secures the physical infrastructure, hardware, network, and hypervisor, while the customer secures data, identities, access policies, and configurations, with the exact boundary depending on the service model (IaaS, PaaS, or SaaS). When migrating an application to the cloud, this model tells you which security controls you still own and which the provider manages. That is precisely why it is the correct answer.
- ✗
Air gap
Why it's wrong here
An air gap is a security measure that physically or logically isolates a system from other networks, often by ensuring there is no routeable connection to the internet, to prevent remote attacks. Moving an application to a cloud provider generally places it on the provider's shared, network-accessible infrastructure, which is the opposite of creating an air gap. This concept addresses network separation, not the division of security responsibilities between provider and customer, so it is incorrect here.
- ✗
Data masking
Why it's wrong here
Data masking is a data protection technique that substitutes sensitive values—such as personal data or payment details—with realistic but fictitious equivalents for use in development, testing, or analytics environments. It reduces the risk of data exposure in non-production scenarios but says nothing about who is accountable for securing cloud infrastructure, runtime platforms, or customer configuration. Therefore, it cannot be the principle governing cloud security responsibility allocation in this scenario.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A team deploys an e-commerce application on an IaaS virtual machine. The cloud provider secures the datacenter, hardware, and hypervisor. The company wants to reduce the chance that attackers exploit outdated software on the VM itself. Which responsibility remains with the company?
medium- A.Replace the cloud provider’s physical security controls with on-site guards.
- ✓ B.Patch and harden the guest operating system and application running on the VM.
- C.Install new firmware on the physical host server maintained by the provider.
- D.Set the data center’s perimeter access badge policy.
Why B: In an IaaS model, the cloud provider is responsible for the security of the cloud (datacenter, hardware, hypervisor), while the customer is responsible for security in the cloud. This includes patching and hardening the guest OS and application on the VM. The company must manage vulnerabilities in the software stack it controls to prevent exploitation of outdated components.
Variation 2. A company uses a SaaS CRM platform. The provider patches the application and underlying infrastructure. Which two responsibilities remain with the company? Select two.
medium- ✓ A.Set up MFA, conditional access, and user-role assignments for tenant accounts.
- B.Patch the SaaS application's source code on the provider's servers.
- ✓ C.Decide what customer data is entered into the service and how it is shared.
- D.Replace the provider's hypervisors with company-owned hardware.
- E.Maintain the provider's network firewalls and datacenter cooling systems.
Why A: In a SaaS model, the customer retains responsibility for securing their tenant accounts, including configuring multi-factor authentication (MFA), conditional access policies, and role-based access control (RBAC) for users. These are identity and access management (IAM) controls that the provider cannot enforce on behalf of the customer, as they depend on the customer's specific user directory and security policies.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.