In cloud deployments, which statement reflects the shared responsibility model?

• A. Provider handles all controls.
• B. Customer handles all controls.
• C. Security is optional.
• D. Cloud provider handles some controls; the customer is responsible for others; effective security requires clear delineation and governance.

Answer: (D)

In cloud deployments, security responsibilities are shared between the provider and the customer. The provider handles the security of the cloud infrastructure itself—things like the physical data center, network, virtualization, and other foundational services. The customer is responsible for security in the cloud—data protection (encryption, classification), access control and identity management, application configuration, and securing workloads that run in the cloud. The exact split depends on the service model (IaaS, PaaS, SaaS), but the principle remains: both sides have duties, and effective security comes from clearly delineating who does what and governing those responsibilities through policies, roles, and compliance controls.

Why this fits best: it reflects the collaborative nature of cloud security and the need for governance to ensure all necessary controls are covered. Saying the provider handles all controls ignores the customer’s responsibilities; saying the customer handles all controls ignores the provider’s duty to secure the underlying platform; claiming security is optional is simply incorrect.