Who Secures a Database in IaaS Under Shared Responsibility?

SY0-701 By islever Editorial Last updated

Compare and contrast security implications of different architecture models.

Short answer

A Under the IaaS shared responsibility model, the client must secure the company database, including its data, access controls, and configuration, while the provider secures the underlying infrastructure.

Question

Which of the following roles, according to the shared responsibility model, is responsible for securing the company’s database in an IaaS model for a cloud environment?
  1. Client Correct Answer
  2. Third-party vendor
  3. Cloud provider
  4. DBA

Key Takeaways

It tests whether you can separate the cloud provider's infrastructure duties from the customer's responsibility for the guest OS, database configuration, and data in IaaS, with DBA as the main trap.

This SY0-701 question tests the shared responsibility model in IaaS and establishes that the client—not the cloud provider, third-party vendor, or DBA role—is responsible for securing the company database.

Common mistake: Choosing D because a DBA administers the database; DBA is an internal job title, while the shared responsibility model assigns the client/customer accountability for securing the database in IaaS.

Expert Analysis

The dividing line in IaaS In an IaaS deployment, the cloud provider secures the physical data center, network fabric, storage hardware, and virtualization layer. The client—the cloud customer—secures everything it places above that line: the guest operating system, middleware, runtime, application code, data, and the database engine with its configuration. Because the company's database is deployed and controlled by the customer in IaaS, option A is the correct answer.

Why the tempting alternatives fail Option C (Cloud provider) would fit only if the provider offered a managed database service that absorbed more of the stack—typically DBaaS or PaaS—where it patches the engine and OS, although the client usually still owns data, identity, and configuration duties. Option B (third-party vendor) has no default responsibility in the shared responsibility model unless a separate contract assigns one. Option D (DBA) is an organizational job title, not a party in the model; as one learner put it, “the DBA is a job title, not a column in the shared-responsibility chart.” A DBA may perform client-side hardening, but the client remains accountable.

Adjacent decisions and consequences The same knowledge helps classify nearby scenarios: an IaaS database means the client secures the database engine and data; a managed DBaaS/PaaS offering shifts platform patching to the provider, but the client still owns access, data, and configuration; SaaS shifts more to the provider, yet the client still governs users and data. If you answer C, you may assume the provider is patching and hardening a database it does not manage, leaving public exposure, weak authentication, missing encryption, and unpatched engines. If you answer D, you create an accountability gap by treating a single internal role as the whole responsibility model. When the wording shifts from “who is responsible” to “who administers,” DBA may fit; under the shared responsibility model, choose Client.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question names IaaS and asks who secures an application or database, draw the stack: provider below the hypervisor, customer above it. The customer controls the guest OS, database engine, configuration, identities, and data, so choose the client unless the scenario explicitly describes a managed DBaaS/PaaS service. Treat named job titles such as DBA as distractors because the shared responsibility model uses provider-versus-customer roles, not internal organizational charts.

Frequently Asked Questions

In IaaS, why doesn't the cloud provider secure the database because it runs on provider infrastructure?

The provider secures the physical facilities, network, storage, and virtualization layer. The customer secures the guest OS, database engine, configuration, identities, and data it deploys in IaaS.

Why is the DBA not the correct answer under the shared responsibility model?

DBA is an organizational job role, not a party in the shared responsibility model. A DBA may perform client-side database hardening, but accountability remains with the client/customer.

What changes if the database is offered as a managed DBaaS or PaaS service?

The provider may manage the database engine, patching, and platform, shifting more responsibility upward. The customer still typically owns data classification, access governance, and configuration choices.

More SY0-701 FAQ →

Community Votes

A
83%
D
17%

83% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 9 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 9

  1. metzen227 👍 17
    Client: In the shared responsibility model, the client, or cloud customer, is responsible for securing their data and applications running on the cloud infrastructure. This includes configuring security settings, implementing access controls, and managing user permissions for their resources. However, the specific responsibility for securing the company's database in an Infrastructure as a Service (IaaS) model depends on the division of responsibilities outlined in the model. Given the options provided and the context of the shared responsibility model for a cloud environment, the most appropriate role responsible for securing the company's database in an IaaS model would be Client. The client is typically responsible for securing their data and applications, including databases, within the cloud infrastructure. However, the DBA would also play a significant role in implementing database security measures within the IaaS environment, working in collaboration with the client's security team.
  2. dbrowndiver 👍 12 Answered A
    In the IaaS model, the client is responsible for securing everything above the infrastructure layer provided by the cloud provider. This includes the operating system, applications, and data, which encompasses the security of databases.
  3. Mehsotopes 👍 8 Answered A
    The client is the one who is utilizing the data, & would be responsible in the handling, & security of database within the infrastructure provided by the Cloud Provider, or Third-Party Vendor.
  4. agp2684 👍 3
    You are mistaken. In the cloud shared responsibility model, the DBA is not mentioned; it just refers to the client
  5. e5c1bb5 👍 2
    while a database sounds like a physical piece of equipment, it typically is not. Therefore in the IAAS model configuring the security of the database should be settings, firewall, and othertechnologies that cloud providers typically wont mess with.
Show 4 more comments
  1. Dimpo_Oz 👍 2 Answered A
    Whilst D the Database admin would seem to be the obvious choice the question asks secure not administer, getting the DBA alone to secure is inadequate, you will also need others to completely secure meaning the best answer is A client
  2. spencer0328 👍 2 Answered D
    Exactly D. DBA ,which means Database administrator.
  3. kejo2 👍 1 Answered A
    In an Infrastructure as a Service (IaaS) model, the cloud provider is responsible for securing the underlying infrastructure (physical facilities, networking, storage, and virtualization), while the client/customer is responsible for securing what they deploy in the cloud, including operating systems, applications, and databases. Why A is correct Under the shared responsibility model for IaaS: Cloud provider: Physical hardware, network, hypervisor, and data center security. Client: Operating systems, applications, user access, configurations, and databases. Therefore, securing the company's database is the responsibility of the client organization.
  4. tailogdavid1987 👍 1 Answered A
    IaaS = The customer installs and secures the database. “DBA” is a job title, not a column in the shared-responsibility chart.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide