CRISC · Question #625
Within the risk management space, which of the following activities could be delegated to a cloud service provider?
The correct answer is B. Control implementation. While the customer retains ultimate accountability for risk, cloud service providers can be delegated the responsibility for implementing many infrastructure-level security controls within their shared responsibility model.
Question
Within the risk management space, which of the following activities could be delegated to a cloud service provider?
Options
- ARisk oversight
- BControl implementation
- CIncident response
- DUser access reviews
How the community answered
(50 responses)- A8% (4)
- B72% (36)
- C4% (2)
- D16% (8)
Why each option
While the customer retains ultimate accountability for risk, cloud service providers can be delegated the responsibility for implementing many infrastructure-level security controls within their shared responsibility model.
Risk oversight, including understanding and accepting overall business risks, remains the ultimate responsibility of the customer, not the cloud service provider.
Under the shared responsibility model, cloud service providers are responsible for security *of* the cloud, which includes implementing many foundational controls such as physical security, network infrastructure, and virtualization platform security. This allows customers to delegate the actual execution and maintenance of these specific controls to the CSP.
While CSPs have their own incident response for their infrastructure, the customer is ultimately responsible for responding to incidents affecting their data and applications within the cloud.
User access reviews for customer-managed identities and applications within the cloud environment remain the customer's responsibility.
Concept tested: Cloud shared responsibility model
Source: https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility
Topics
Community Discussion
No community discussion yet for this question.