Where Does the Provider Stop?
Explain the shared responsibility model. Which security failures are still yours after moving to a managed platform?
Practical scenario
After moving to managed services, a team removes security review from its architecture checklist on the grounds that "the provider handles it". Six weeks later an object storage bucket holding customer exports is found publicly readable.
What it tests
Answer it out loud first. The guide below stays closed until you ask for it, on purpose.
- Whether the candidate can draw the boundary concretely rather than recite the phrase
- Whether they know the boundary moves by service type
- Whether they can list the failures that remain theirs
Reading a strong answer is not the same as producing one. Commit to what you would say, then compare.