Cloud Architecture, Models and Shared Responsibility
This domain tests your ability to place each control on the correct side of the shared responsibility line and to design tenancy and segmentation that limit blast radius.
The responsibility line moves by model
The provider is always responsible for security of the cloud: facilities, hardware, and the hypervisor. The customer is always responsible for security in the cloud: data, identities, endpoints, and configuration. Between those anchors the line slides. In IaaS the customer patches the guest OS and everything above it. In PaaS the provider patches the runtime and middleware while the customer owns application code, configuration, and data. In SaaS the customer retains identity, access, data classification, and sharing configuration. CSA's Shared Responsibility Model and the "shared fate" view add the practical point that provider incidents still become your incidents.
Architecture controls that earn marks
Regions are geographic; availability zones are isolated failure domains inside a region. Landing zones standardize account structure, centralized logging, networking, and guardrails before workloads arrive. Segmentation via VPCs/VNets, subnets, security groups, and private endpoints reduces east-west movement. Immutable, version-controlled infrastructure prevents configuration drift.
Worked example
An analyst is told a public object-storage bucket leaked records. The provider did not misconfigure the bucket; the customer's team did. Correct reasoning: service availability is the provider's responsibility, while bucket policy, IAM permissions, encryption selection, and data classification are the customer's. Remediation therefore belongs in the customer's IaC pipeline and policy-as-code guardrails, not in a support ticket to the provider.
Traps
Assuming the provider patches the guest OS in IaaS. Believing SaaS removes all customer duties - tenant identity and sharing settings remain yours. Treating a region choice as a residency guarantee without checking replication and provider support access. Forgetting that managed services still require customer-side configuration review.