Explain the shared responsibility model. Where does the cloud provider's job end and yours begin?
What they are really testing: They are checking whether you assume the cloud is secure by default. The real test is whether you know the breaches that hit customers are almost always on the customer's side of the line.
A real interview question
Explain the shared responsibility model. Where does the cloud provider's job end and yours begin?
What most people say
drag me
“The cloud provider handles security, so as long as I use AWS or Azure my data is safe.”
It assumes the provider covers everything, which is exactly the mindset that leaks data. It misses that the customer owns access control and configuration.
The follow-ups they ask next
Give a concrete example of something on your side that often goes wrong.
Point to a public object storage bucket or an identity with admin permissions it does not need. Tie it to least privilege.
How does the boundary differ between a virtual machine and a managed database?
With the VM you patch the OS and database engine; with the managed database the provider patches the engine and you own access, data, and backups configuration.
What the interviewer is listening for
- say security of versus security in the cloud
- note the line shifts by service type
- name access control as your job
- cite real customer-side breach patterns
What sinks the answer
- assume the provider covers everything
- leave the customer with no responsibilities
- forget identity and access management
- treat the boundary as fixed across all services
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“The provider is responsible for [security of the cloud, the hardware and data centers], and I am responsible for [security in the cloud, my data and access controls]. The line shifts depending on [how managed the service is], and most breaches happen because [the customer left something like a bucket or an identity too open].”
Keep going with security
Foundation
What is the CIA triad, and why is it a useful way to think about security?
Foundation
What is the difference between authentication and authorization?
Junior
What is the difference between encryption at rest and in transit, and why do you need both?
Junior
How should an application running in the cloud get credentials to call other cloud services? Why avoid long-lived access keys?
Junior
What is the difference between symmetric and asymmetric encryption, and where is each used?
Mid
What does it mean to "shift security left", and how would you build security into a CI/CD pipeline?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free