From a TA perspective, which statement best describes the Cloud Shared Responsibility Model?

• A. Cloud provider handles attestation across all shared components.
• B. TA ensures attestation and monitoring across shared components.
• C. TA is responsible for attestation and monitoring across shared components.
• D. Attestation is not needed in cloud environments.

Answer: (C)

In cloud security, responsibilities are split: the provider locks down the infrastructure, while you configure and use the cloud to meet policy and risk requirements. Attestation is about proving the trust and integrity of the components you deploy and the shared environment you manage. Because these controls involve your configurations, telemetry, and ongoing verification across the parts of the stack that you share with the provider, the TA is responsible for attestation and continuous monitoring of those shared components. The provider may offer attestations for their portion, but the overall attestation and monitoring of the shared environment is owned by you as the TA. Attestation remains a needed practice in cloud environments, and it’s not solely the provider’s job.