Microsoft 365 FundamentalsDescribe cloud conceptsHard
A retail company is migrating its on-premises inventory management system to the cloud. They are concerned about the security of their data and want to understand who is ultimately responsible for protecting the data stored in the cloud. According to the shared responsibility model, who is responsible for the data classification and accountability?
- ABoth the cloud provider and the customer equally
- BThe cloud provider only
- CA third-party security auditor
- DThe customer only
Show answer & explanationAnswer & explanation
Correct answer: D. The customer only
In the shared responsibility model, the customer is always ultimately responsible for the data itself, including its classification, sensitivity, and ensuring compliance. While the cloud provider secures the underlying infrastructure, the customer owns and is accountable for the data within that infrastructure.
Why the other options are wrong
- A. While responsibilities are shared, data classification and accountability specifically fall to the customer.
- B. The cloud provider secures the infrastructure, but the customer is responsible for the data content.
- C. A third-party auditor assesses compliance but doesn't hold primary responsibility for data protection.
Shared Responsibility Model
A cloud security framework that outlines the security responsibilities of both the cloud provider and the customer. The provider is responsible for the security 'of' the cloud, and the customer is responsible for security 'in' the cloud.
- Customer always owns and is responsible for data.
- Provider secures the infrastructure.
- Specific responsibilities vary by cloud service model (IaaS, PaaS, SaaS).
Memory trick: Customer Owns Data, Provider Secures Cloud