Skip to content

ACCA Strategic Professional · Strategic Business Leader · IT systems security and control

Brightwater Utilities has moved its customer portal to a public cloud provider. An internal review notes that a misconfigured storage bucket exposed records, although the provider's infrastructure was not breached. Which conclusion is most consistent with the shared responsibility model?

Brightwater remains responsible for securing its data and configuring access correctly. In the shared responsibility model the cloud provider protects the underlying infrastructure, while the customer manages its own configuration, data and access. The exposure came from a customer-side misconfiguration, so accountability stays with Brightwater.

  1. AThe provider is fully accountable because it hosts the data
  2. BBrightwater remains responsible for configuring and securing its own data and access settingsCorrect
  3. CResponsibility passes to customers whose data was exposed
  4. DNo one is responsible because the cloud is outside the firm's control

Explanation

Under shared responsibility, the provider secures the underlying infrastructure while the customer secures its data, configuration and access management. The exposure arose from Brightwater's own misconfiguration, so accountability stays with it. Outsourcing hosting does not outsource accountability.

Did you get it right without looking?

One question tells you little. A timed set on IT systems security and control shows your real accuracy, how long you take and where you lose marks.

Practise IT systems security and controlFree diagnostic mock

More IT systems security and control questions