Cloud Digital Leader Fundamental Cloud Concepts Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Google is responsible for security of the infrastructure; customers are responsible for their data and configurations.

  Why this is correct

  In the shared responsibility model, Google Cloud operates and secures the physical infrastructure layer, including data centers, servers, storage, networking hardware, and the hypervisor. The customer retains responsibility for what they control: their data, identity and access management (IAM) policies, and configuration of services such as encryption, firewalls, and OS-level hardening. This split ensures that each party focuses on the components it is best positioned to protect.

• ✗

  Google is responsible for all security aspects, including customer data.

  Why it's wrong here

  This option incorrectly assumes a fully managed security posture, but Google explicitly does not take responsibility for the customer's data, identities, or access choices. Customers control IAM roles, encryption keys, and data classification, and while Google provides security features like Cloud CMEK, it cannot enforce how they are used. Liability remains with the customer for their content and compliance obligations, so security is not wholly delegated to the provider.

• ✗

  Customers are responsible for physical security of data centers.

  Why it's wrong here

  Physical data-center security is solely Google's responsibility because Google owns and operates the facilities, with layered controls like biometric entry, break-glass procedures, and 24/7 guards. Customers access only the control plane via network APIs, never the data center premise, so they have no physical security obligations under the model. This option reverses the clear split between provider and customer, misassigning the duty that Google carries.

• ✗

  Security is entirely the customer's responsibility in IaaS.

  Why it's wrong here

  While IaaS moves more work to the customer, the provider is still responsible for securing the underlying hardware, virtualization layer, and physical network. The customer must secure the guest OS, runtime, data, and access on top of that, but this shared division means security is not entirely on the customer. Google has contractual and operational duties, so this option ignores the infrastructure side of the model and overstates the customer's burden.

Go deeper

Related to this question