A cloud customer configured and developed a solution on top of the certified cloud services. Building on top of a compliant CSP:

The correct answer is D. does not necessarily mean that the cloud customer is also compliant. This is a fundamental principle of the shared responsibility model. A CSP may hold certifications (e.g., ISO 27001, SOC 2, FedRAMP) for the infrastructure and services they manage, but compliance does not automatically transfer to the cloud customer. The customer is still…

Cloud Compliance

Question

Options

Ameans that the cloud customer is also compliant.
Bmeans that the cloud customer and client are both compliant.
Cmeans that the cloud customer is compliant but their client is not compliant.
Ddoes not necessarily mean that the cloud customer is also compliant.

How the community answered

(33 responses)

A
3% (1)
B
6% (2)
C
3% (1)
D
88% (29)

Explanation

This is a fundamental principle of the shared responsibility model. A CSP may hold certifications (e.g., ISO 27001, SOC 2, FedRAMP) for the infrastructure and services they manage, but compliance does not automatically transfer to the cloud customer. The customer is still responsible for how they configure, develop, and operate their solution on top of that infrastructure. For example, a CSP may be HIPAA-eligible, but if the customer misconfigures access controls or fails to encrypt PHI, the customer is not compliant. Compliance is inherited only for the specific controls the CSP manages - not end-to-end.

Topics

#Shared Responsibility Model#Cloud Compliance#Customer Responsibility#Compliance Scope

Community Discussion

No community discussion yet for this question.

Full CCAK Practice