What does the shared responsibility model mean in cloud security?

• A. The customer is responsible for everything; cloud provider handles nothing.
• B. The cloud provider secures parts of the stack; the customer is responsible for remaining controls (data, access management, encryption, configuration) depending on service type.
• C. There is no shared responsibility; security is only the provider's job.
• D. Responsibilities are fixed and do not vary by service model.

Answer: (B)

In cloud security, the shared responsibility model means security tasks are split between the provider and the customer, and who handles what depends on the service model. The cloud provider takes care of the security of the cloud itself—the underlying infrastructure, physical hardware, networking, and foundational services. The customer is responsible for the remaining controls that sit in their managed space, such as protecting data, managing access (identities and permissions), implementing encryption, and configuring services securely.

Understanding this across service models helps: in infrastructure‑as‑a‑service, you manage more of the stack (your data, OS, applications, and their configurations), while the provider handles the hardware, virtualization, and foundational layers. In platform‑as‑a‑service, the provider takes on more of the runtime and platform security, but you still control data and access. In software‑as‑a‑service, the provider manages most security, and you primarily focus on your data, user access, and how you use the service.

This description aligns with the idea that security responsibilities are shared and vary by how the cloud service is used.