The cloud shared responsibility model
the security boundary in PaaS.
the provider secures the cloud (hardware, OS, runtime), you secure what runs in it (code, data, config, access).
assuming the provider secures your code, data, or IAM.
What's really being asked
This checks whether you understand that moving to the cloud does not outsource all security, and that the division of duties changes with the service model.
The full answer
The shared responsibility model splits ownership of the stack between the provider and you. The provider is responsible for security of the cloud: physical datacenters, host hardware, the hypervisor, the underlying network, and, in a PaaS, the operating system and the managed language runtime including their patching. You are responsible for security in the cloud: your application code and its dependencies, your data and its encryption choices, identity and access management, network and firewall rules you configure, and correct service configuration. With PaaS like Elastic Beanstalk or App Engine the provider handles more than with raw IaaS, where you would also own OS patching, but in every model your code, your data, and your access policies remain yours.
The mistakes people make
Thinking the provider secures everything once you deploy. Blaming the provider for a breach caused by a public storage bucket, weak IAM, or a vulnerable dependency. Believing the line is fixed across IaaS, PaaS, and SaaS rather than shifting.
What usually comes next
How does the boundary differ between IaaS, PaaS, and SaaS? Who patches the OS in PaaS versus IaaS? Who is responsible for encrypting data at rest and managing keys? Give an example of a customer-caused breach.
A concrete example
You deploy a Django app to App Engine. Google patches the host OS, the Python runtime, and the load balancer, so a kernel vulnerability is their problem to fix. But if you commit an API key to your repo, leave a Cloud Storage bucket public, or grant an overly broad IAM role, that is squarely your responsibility, and Google's secure platform does not protect you from your own misconfiguration.
Interview question
Under the shared responsibility model on a PaaS, which of these remains the customer's responsibility?
- a.Maintaining the hypervisor that isolates tenant workloads
- b.Configuring IAM roles, application code, and data access correctlyCorrect
- c.Securing the physical datacenter and networking hardware
- d.Patching the host operating system and managed language runtime
Why? this is the answer
On PaaS the provider handles the OS, runtime, and hardware, but the customer always owns their code, data, and access configuration. IAM and config mistakes are the customer's responsibility, not the provider's.
Just read this? Test yourself on what you have been reading.
Read the original → learn.microsoft.com
Put your scrolling time to good use
Learn one idea, try a quiz and save useful cards for revision. Tezvyn makes it easy to learn and stay current in your tech field, a few minutes at a time.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles