CCNA Cloud Security Fundamentals And Shared Responsibility Questions

Cloud-native security tools enforce policies automatically across accounts and resources, removing reliance on manual checks and reducing drift. This satisfies the question's demand for a primary security benefit by delivering consistent, scalable policy enforcement integrated with the provider's control plane.

RDS is a managed service where AWS handles the underlying host and engine patching, but the customer still owns the data, its classification, database user permissions, and how encryption keys are used. This split matches the shared responsibility model for managed database services and gives the auditor an accurate boundary for the regulated data scenario.

Identity and Access Management is a critical component because it enforces authentication and authorisation, ensuring only verified users and services reach cloud resources. Microsoft Entra ID provides this through conditional access, role-based access control and multi-factor authentication, directly satisfying the stem's requirement for a comprehensive strategy covering access control.

Automated guardrails enforce security policy through preventive controls such as organisation policies, admission controllers and IaC validation, removing reliance on manual review. They satisfy the secure cloud-native constraint by applying consistent, auditable restrictions across rapidly changing, ephemeral workloads and developer pipelines.

Microsoft operates and secures the physical HSM appliances within its datacentres under the shared responsibility model. Customers retain responsibility for key material, access policies and secret lifecycle, but hardware tamper protection, firmware and facility controls sit with Microsoft, satisfying the stem's hardware-layer constraint.

AWS security groups are stateful firewalls that start with no inbound rules, so every packet is implicitly denied until an allow rule is added. This default-deny posture satisfies the stem's requirement, since traffic only reaches the instance once you explicitly permit the relevant protocol and port range.

In a PaaS offering like Azure App Service, the customer is responsible for the application code and data, including protecting sensitive patient information. Microsoft secures the underlying platform, runtime, and infrastructure. The startup must implement secure coding practices, data encryption, and access controls for the portal. This aligns with the shared responsibility model where data and application security always belong to the customer.

Data classification is always a customer responsibility because only the customer understands the business value and regulatory sensitivity of its data. No provider can determine which records are regulated or how they should be protected. This responsibility persists across IaaS, PaaS, and SaaS, making it a constant in every cloud deployment.

Even in a PaaS model, the customer controls who can access the data and how. Configuring Azure SQL firewall rules, enabling Azure Active Directory authentication, and assigning proper roles are customer responsibilities. Microsoft secures the platform, but identity and access management for the data layer remain with the customer. This is a core tenet of the shared responsibility model for PaaS.

Cloud providers define their shared responsibility models differently, using distinct terms and service categorizations. AWS, Azure, and Google Cloud draw the line between provider and customer responsibilities at different points for similar services. This inconsistency makes it challenging to create a unified control framework and can lead to security gaps. The architect must carefully map each provider's model to avoid misconfigurations and ensure consistent security posture.

In SaaS, the provider manages the application, runtime, operating system and infrastructure, leaving the customer responsible only for their own user access management and the data they place into the service. This satisfies the scenario's focus on what remains customer-controlled under SaaS.

CSPM continuously compares deployed cloud resources against defined baselines and compliance benchmarks, flagging or automatically correcting deviations such as opened ports or disabled encryption. Detecting and remediating configuration drift is its core function, distinguishing it from workload protection or identity governance tools.

Identity-based access policies evaluate every request against user identity, device posture and context before granting access, satisfying Zero Trust's verify-explicitly constraint; static network perimeters cannot authenticate requests, so identity policies are the critical verification component.

Grouping users into a single IAM object lets administrators assign permissions once, and every member inherits them, satisfying the stem's requirement to reduce repetitive per-user administration. Microsoft Entra ID evaluates group membership at token issuance, so access changes propagate without editing individual accounts, cutting configuration drift and error.

This statement accurately reflects the shared responsibility model. The provider secures the physical infrastructure, hypervisor, and network, while the customer secures data, applications, and access management. This division applies across IaaS and PaaS, though the customer's scope varies.

Microsoft owns and maintains the datacentre hardware, including servers, storage and network equipment, plus physical security and hardware patching. The customer never touches this layer, so hardware maintenance falls squarely under the provider's responsibility for physical infrastructure.

CloudTrail records every API call made in the account, capturing the caller identity, timestamp, source IP and action taken. This audit trail is what lets you detect unauthorised or anomalous API activity, directly satisfying the stem's monitoring requirement.

Bucket policies, ACLs and access settings are configuration within the customer's control plane. AWS secures the S3 service itself, but deciding who may read an object is the customer's task, so the customer must restrict public access.

In a self-managed container orchestration platform, the organization is responsible for the worker nodes, including OS patching, hardening, and vulnerability management. The cloud provider only secures the underlying virtual machine infrastructure, but the guest OS and orchestration layer are the customer's duty. This is a critical task to prevent node compromise and lateral movement.

Database user access control stays with the customer because Cloud SQL operates under the shared responsibility model: Google secures the underlying infrastructure, network and patching, while authentication, authorisation and privilege assignment inside the database instance remain yours. This satisfies the stem's constraint of identifying a customer-owned task rather than a provider-managed one.

Exposed buckets frequently hold personal or regulated data, so unauthorised access breaches statutes such as GDPR or HIPAA, triggering fines and notification duties. This satisfies the stem's risk criterion by naming a compliance consequence rather than a purely technical exposure.

Least privilege access limits each identity to only the permissions its function requires, shrinking the blast radius if credentials are compromised. Zero Trust assumes no implicit trust, so this restriction is a foundational pillar alongside verify explicitly and assume breach.

In a managed database service (PaaS), the provider is responsible for patching the database engine, applying security updates, and maintaining the underlying infrastructure. The customer focuses on data, access, and configuration, while the provider handles the engine patching.

Each provider draws the shared responsibility boundary differently, so controls the customer assumes are vendor-managed in one cloud may be their own in another, creating coverage gaps; this variance is the most significant multi-cloud challenge.

Shift-left security testing integrates SAST, dependency scanning, and infrastructure-as-code checks into CI/CD pipelines, catching flaws before deployment. This is a recognised cloud-native practise, satisfying the stem's requirement for a common security approach in cloud-native environments.

The container image supplies every layer, package and configuration the workload runs, while the runtime governs its execution. Flaws baked into the image or exposed at runtime propagate to every deployed instance, so securing these satisfies the stem's focus.

Identity and access management (IAM) is always a customer responsibility. The customer must define who can access what resources and under which conditions. AWS provides IAM services, but the customer configures policies, roles, and permissions. This applies across all service models. Poor IAM configuration is a leading cause of breaches, so the customer must continuously manage and audit access.

In a SaaS model, the customer is responsible for managing its own users, access controls, and data. While the provider secures the application infrastructure, the customer must configure who can access the CRM and what they can do. This includes setting up authentication, authorization, and role-based access. The customer also remains responsible for the data they enter into the system and its classification.

Publicly shared IaC templates expose any hardcoded credentials, API keys or insecure defaults embedded in the code, since version control retains full history. This satisfies the scenario by naming the concrete exposure created when templates are visible outside the trusted team.

Immutable infrastructure rebuilds and replaces instances rather than patching them in place, eliminating configuration drift and persistent compromise. This aligns with cloud-native practise, where declarative provisioning and automated replacement make mutable, long-lived servers an anti-pattern.

Infrastructure as Code stores environment definitions declaratively in version control, so a compromised or corrupted environment can be torn down and redeployed identically within minutes. This satisfies the rapid restoration constraint, whereas manual rebuilds or backups alone restore data but not consistent, reproducible infrastructure configuration.

Shift Left moves security earlier into the software development lifecycle, so developers rather than a downstream security team own compliance during design and build. This satisfies the stem's requirement by relocating responsibility upstream to the phase where defects are cheapest to fix.

Under the AWS Shared Responsibility Model, the customer always owns their data, so securing it in the cloud — through encryption, access controls and classification — remains a customer duty. AWS secures the cloud infrastructure itself, but never the customer's content, satisfying the 'security of the cloud versus in the cloud' split.

Least privilege grants each identity only the permissions its task requires, so unused entitlements cannot be abused. This directly shrinks the attack surface, satisfying the stem's stated goal of limiting permissions rather than merely detecting or logging excessive access after the fact.

Host-level physical security and hypervisor integrity sit beneath the customer's control boundary, so the cloud provider owns them under the shared responsibility model. Customers cannot patch a hypervisor or guard a datacentre rack, satisfying the stem's constraint that the area is primarily the provider's responsibility rather than the tenant's.

Cloud-native security shifts controls left by embedding scanning, policy checks and secrets detection directly into build and deployment pipelines, so misconfigurations are caught before release rather than audited afterwards. This continuous, automated integration is a defining characteristic.

GKE Standard leaves workload-level security to the customer. The provider must define Kubernetes RBAC roles, apply network policies to restrict pod traffic, and enforce pod security standards. These controls protect the healthcare workloads and are squarely within the customer's responsibility under the shared model.

AWS Config continuously records resource configurations and evaluates them against rules, flagging drift and non-compliant changes. It provides the configuration history and compliance visibility the stem requires, unlike CloudTrail, which logs API activity rather than resource state.

Strong, unique passwords reduce the risk of credential stuffing and brute-force attacks against console sign-in. Because the console authenticates with a username and password, credential strength is a customer-controlled defence that directly limits unauthorised access.

Under the shared responsibility model, AWS secures the cloud while the customer secures what they put in it. A public S3 bucket results from misconfigured resource permissions, breaching the customer's configuration and data security duty.

Even in serverless, the customer controls identity and access. The startup must configure managed identities, role assignments, and Key Vault access policies so the function can retrieve secrets securely. This is a core customer responsibility and directly relevant to protecting the API and its secrets.

Under IaaS, the provider secures the physical hosts, network and hypervisor, but the guest operating system remains the customer's domain. Patching that OS is therefore the customer's primary responsibility, directly satisfying the stem's requirement to maintain guest OS security.

In an IaaS model like Azure Virtual Machines, the customer is responsible for the guest operating system, including patching, hardening, and configuration. Microsoft manages the hypervisor and physical hosts, but the customer controls the OS and installed software. This includes setting up firewalls, antivirus, and access controls on the VMs. Thus, managing the guest OS configuration is a customer task.

When using a managed database, the customer can choose to manage their own encryption keys via a key management service. This includes key rotation, access policies, and revocation. While the provider offers encryption by default, customer-managed keys give the customer control and responsibility. This is a critical customer task to protect data confidentiality.

The customer is responsible for defining the IAM role and permissions for the function. This includes specifying which resources the function can access and what actions it can perform. Properly scoping permissions is critical to prevent privilege escalation and limit the blast radius of a compromised function. This is a core customer responsibility in FaaS.

In PaaS, the provider manages the underlying infrastructure, including the OS, runtime, and middleware. The customer is responsible for the application code, data, and access controls. This division allows the customer to focus on development while the provider handles platform maintenance. This is a core characteristic of the shared responsibility model for PaaS.

For IaaS virtual machines in both AWS and Azure, the customer is responsible for managing the guest operating system. This includes applying security patches, configuring the OS, and maintaining its security. The provider manages the hypervisor and physical infrastructure, but the customer controls the OS and applications. This is a fundamental customer duty in IaaS.

Compute Engine is an Infrastructure-as-a-Service product, so the customer retains control of the guest operating system, including kernel patching, package updates, and hardening. Google secures the physical infrastructure and hypervisor, but the kernel inside the VM is the customer's responsibility, making this the accurate division for the scenario.

An IAM role with a trust policy lets the auditor's external identity assume temporary credentials via STS, so no permanent IAM user or long-lived access key is created. This satisfies the requirement for temporary, auditable third-party access without persistent identities.

In IaaS, the customer is responsible for the guest OS, including patching, hardening, and configuring security settings. Google secures the hypervisor and physical host, but the VM's OS is entirely under customer control. This includes updating the kernel, managing users, and configuring firewalls within the OS. This is a defining characteristic of IaaS responsibility.

In IaaS, the customer is responsible for securing the guest operating system, applications, and network controls such as security groups and network ACLs. These are customer-managed firewall rules that control traffic to and from EC2 instances. AWS secures the hypervisor and physical network, but the customer must define and maintain these virtual firewall configurations to protect their instances.

Microservices communicate across network, identity and data boundaries that did not exist in monolithic designs. Mapping these trust boundaries exposes where authentication, authorisation and encryption must be enforced, which is the defining activity of cloud-native threat modelling rather than legacy perimeter-focused analysis.

MFA requires a second, independent factor beyond the password, so a compromised credential alone cannot authenticate. This satisfies the scenario by adding identity verification that resists credential theft, phishing and password reuse in the cloud environment.

With Cloud Run, the customer is responsible for securing the application code, its dependencies, and the IAM policies that control access to the service and its resources. Google manages the underlying infrastructure, but identity and access management remains a customer duty. Properly configuring IAM roles ensures least privilege and prevents unauthorized access to the deployed service.

Patching the application software falls entirely to the SaaS provider, since customers only consume the hosted application and cannot access its underlying code or runtime. This satisfies the stem's exclusivity constraint: in SaaS, application-layer maintenance sits wholly with the provider, unlike IaaS or PaaS where customers patch their own workloads.

VPC Service Controls draw service perimeters around GCP resources, blocking data movement across the boundary even with valid credentials. This satisfies the scenario by preventing exfiltration, containing the blast radius of compromised identities or insider misuse.

Amazon secures the EKS control plane infrastructure, but Kubernetes-level authorisation stays with the customer. Defining RBAC roles and network policies enforces who and what may act inside the cluster, satisfying the stem's control plane security requirement.

Organization Policy Service applies constraints hierarchically across the resource tree, restricting actions such as public IP creation or external sharing regardless of individual IAM grants. This enforces centralised configuration guardrails, satisfying the stem's requirement for organisation-wide, inheritance-based policy control rather than per-project permissions.

Security groups are virtual firewalls that the customer configures to allow or deny traffic. AWS provides the security group functionality, but the customer defines the rules. This is a critical customer responsibility to restrict access to EC2 instances. Misconfigured security groups are a common cause of data breaches. The customer must regularly review and update these rules based on least privilege.

Data classification and access management are always the customer's responsibility, regardless of IaaS, PaaS, or SaaS. The customer owns the data and must classify it, define access policies, and manage identities. The provider secures the infrastructure but never assumes responsibility for customer data governance.

In an IaaS model like Amazon EC2, the customer is responsible for securing everything from the guest operating system up. This includes patching the OS, configuring firewalls, and managing access controls. AWS handles the hypervisor and physical infrastructure, but the company must patch its own EC2 instances and the applications running on them. This is a fundamental tenet of the shared responsibility model.

In Microsoft 365, the customer is responsible for configuring multi-factor authentication (MFA) for user accounts. Microsoft provides the MFA capability, but enabling and enforcing it is a customer task. MFA is critical to protect against credential theft. The customer must also manage user identities and access policies. This is a clear customer responsibility in SaaS, where identity management remains with the tenant.

In an IaaS model like Compute Engine, the customer is responsible for the guest OS, including patching, hardening, and configuration. Google manages the hypervisor and physical infrastructure, but the customer must maintain the operating system and installed software.

In SaaS, the customer is responsible for managing their data, including configuring data loss prevention (DLP) policies, setting user access rights, and ensuring proper classification. Microsoft provides the DLP capabilities, but the customer must define and apply the policies. This includes managing user identities, roles, and permissions. The customer must also monitor for insider threats and data exfiltration.