Shared responsibility model across service tiers

WHAT THIS TESTS The interviewer wants to confirm you understand the shared responsibility model as a sliding boundary rather than a fixed line, and that you can place a concrete task on the correct side for two different service tiers.

A GOOD ANSWER COVERS The model splits duties between security of the cloud, always the provider's job, covering physical data centers, hardware, and the virtualization layer, and security in the cloud, the customer's job, covering what they deploy and configure. The exact line moves with the level of abstraction. For an IaaS compute service like EC2 or plain VMs, the provider secures the hypervisor and below, but you own the entire guest operating system: you apply OS patches, harden the configuration, manage the firewall rules, control identity and access, and protect your data and application. For a managed database like RDS or Azure SQL, the provider absorbs more: it patches and maintains the underlying operating system and database engine, handles backups and the high-availability plumbing, while you remain responsible for your data, schema, user and access management, network exposure such as security groups, and encryption choices. The same logic extends to serverless and SaaS, where the provider takes on still more. Using OS patching as the litmus test: it is your job on the IaaS VM and the provider's job on the managed database.

COMMON WRONG ANSWERS Believing the cloud provider secures everything once you are in the cloud. Thinking a managed service means zero customer security duties; you still own data and access. Assuming the boundary is identical across all service types.

LIKELY FOLLOW-UPS Who is responsible for database backups in RDS? Where does encryption configuration fall? How does the model shift for serverless?

ONE CONCRETE EXAMPLE A critical OS CVE drops. On your EC2 fleet you must schedule and apply the patch yourself; on your RDS instance the provider applies the engine and OS patch during a maintenance window, and you only choose when that window runs.