How does cloud security differ across IaaS, PaaS, and SaaS models, and what is the shared responsibility model?

How does cloud security differ across IaaS, PaaS, and SaaS models, and what is the shared responsibility model?

• A. In IaaS, customers manage apps and data; in PaaS, they manage apps and data with provider managed runtime; in SaaS, most controls are provider-managed; shared responsibility defines who secures what.
• B. In IaaS, provider manages apps; in PaaS, customer manages runtime; in SaaS, customer manages security.
• C. In IaaS, customers manage everything; in PaaS, provider manages everything; in SaaS, provider manages nothing.
• D. In IaaS, only network security matters.

Answer: (B)

The main idea being tested is how security responsibilities are divided among IaaS, PaaS, and SaaS and how the shared responsibility model spells out who handles which controls at each layer. In IaaS, the cloud provider takes care of the foundational infrastructure—physical security, network, and the virtualization layer. The customer, meanwhile, is responsible for securing the guest operating system, any runtime or middleware they install, their applications, and the data they store, as well as access control and encryption keys. As you move to PaaS, the provider assumes more of the platform and runtime security, while you focus on securing the applications you build and the data you store, including configuration and access management. With SaaS, the provider manages the entire application stack, platform, and underlying infrastructure, leaving you primarily responsible for your data, user access policies, and the governance around how you use the service. The shared responsibility model is the framework that clarifies these boundaries so security tasks aren’t overlooked. The key takeaway is that liability and control shift toward you as you consume higher-level services, and you must understand where the provider’s responsibilities end and yours begin. The idea you’re studying is this progression of responsibility and the explicit delineation of who secures what at each service level.

The main idea being tested is how security responsibilities are divided among IaaS, PaaS, and SaaS and how the shared responsibility model spells out who handles which controls at each layer.

In IaaS, the cloud provider takes care of the foundational infrastructure—physical security, network, and the virtualization layer. The customer, meanwhile, is responsible for securing the guest operating system, any runtime or middleware they install, their applications, and the data they store, as well as access control and encryption keys. As you move to PaaS, the provider assumes more of the platform and runtime security, while you focus on securing the applications you build and the data you store, including configuration and access management. With SaaS, the provider manages the entire application stack, platform, and underlying infrastructure, leaving you primarily responsible for your data, user access policies, and the governance around how you use the service.

The shared responsibility model is the framework that clarifies these boundaries so security tasks aren’t overlooked. The key takeaway is that liability and control shift toward you as you consume higher-level services, and you must understand where the provider’s responsibilities end and yours begin. The idea you’re studying is this progression of responsibility and the explicit delineation of who secures what at each service level.