A security architect at an enterprise organization is conducting a compliance assessment to map operational and security obligations across various Google Cloud compute delivery models: Compute Engine (Infrastructure as a Service - IaaS) Google Kubernetes Engine (GKE) Standard (Managed Kubernetes) Google Kubernetes Engine (GKE) Autopilot and Cloud Run (Fully managed container platforms / PaaS) The compliance auditor requires explicit documentation detailing which entity manages node operating system (OS) patching, runtime execution environments, container image security, and customer data protection across each deployment architecture. Which statement accurately describes the demarcation of responsibilities under the Google Cloud shared responsibility model?

On Compute Engine, the customer is responsible for guest OS patching and runtime configurations; on GKE Standard, the customer manages node configuration and initiates or configures node OS upgrades; on GKE Autopilot and Cloud Run, Google manages the underlying node OS patching and runtime infrastructure; across all models, the customer retains responsibility for application code, container contents, and data protection.: ### What the Google Cloud shared responsibility model is The **Google Cloud shared responsibility model** defines the distinct division of security, operational, and compliance obligations between Google Cloud (the cloud service provider) and the customer. As organizations transition from Infrastructure as a Service (**IaaS**) to Platform as a Service (**PaaS**) and fully managed container environments, Google assumes greater operational responsibility for lower-level infrastructure, operating systems, and virtualization layers. ### How it meets the compliance mapping requirements - **Compute Engine (IaaS)**: Google secures the physical hardware, data centers, and KVM hypervisor. The customer retains full ownership and responsibility for selecting, configuring, hardening, and regularly patching the **guest operating system**, middleware, runtime stacks, and firewall rules. - **GKE Standard**: Google provisions and maintains the control plane (master nodes, Kubernetes API, etcd). The customer maintains administrative control over the worker node pools, including configuring autoscaling parameters, selecting node OS images, and managing node upgrade cycles or maintenance windows. - **GKE Autopilot & Cloud Run (PaaS / Managed Containers)**: Google manages and patches the underlying node infrastructure, operating system kernels, container runtime engines, and scaling mechanisms automatically. - **Universal Customer Responsibilities**: Across all deployment architectures (IaaS, PaaS, or SaaS), the customer **always** retains sole responsibility for securing their **application logic**, scanning and remediating vulnerabilities in **container images**, defining **Identity and Access Management (IAM)** policies, and enforcing **data classification and data protection**. ### Key advantages and capabilities - **Reduced operational overhead**: Migrating from IaaS to GKE Autopilot or Cloud Run shifts operating system maintenance, security hardening, and infrastructure patching to Google SRE teams. - **Consistent governance**: Centralized customer responsibilities—such as IAM, data governance, and application security—remain uniform regardless of the underlying execution platform. - **Hardened baseline**: Managed container environments provide pre-configured, attested platform baselines that align with industry compliance benchmarks. ### Why this is optimal This mapping correctly reflects the exact boundaries of operational control across compute architectures. It ensures that internal compliance teams accurately assign operational patch management tasks without creating security blind spots.

Security Demarcation Iaas Paas Gke Cloud Run | Professional Cloud Security Engineer

Security Demarcation Iaas Paas Gke Cloud Run

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A security architect at an enterprise organization is conducting a compliance assessment to map operational and security obligations across various Google Cloud compute delivery models:

Compute Engine (Infrastructure as a Service - IaaS)
Google Kubernetes Engine (GKE) Standard (Managed Kubernetes)
Google Kubernetes Engine (GKE) Autopilot and Cloud Run (Fully managed container platforms / PaaS)

The compliance auditor requires explicit documentation detailing which entity manages node operating system (OS) patching, runtime execution environments, container image security, and customer data protection across each deployment architecture.

Which statement accurately describes the demarcation of responsibilities under the Google Cloud shared responsibility model?

On Compute Engine, the customer is responsible for guest OS patching and runtime configurations; on GKE Standard, the customer manages node configuration and initiates or configures node OS upgrades; on GKE Autopilot and Cloud Run, Google manages the underlying node OS patching and runtime infrastructure; across all models, the customer retains responsibility for application code, container contents, and data protection.

GKE Autopilot and Cloud Run eliminate all customer security responsibilities—including application vulnerability management, container access controls, and data protection—by transferring total end-to-end compliance accountability to Google.

Across all compute delivery models (IaaS, PaaS, and managed containers), Google is responsible for OS patching, middleware installation, and firewall rule configurations, whereas the customer is solely responsible for physical security and hardware asset disposal.

On Compute Engine and GKE Standard, Google automatically patches and maintains the host operating system; on Cloud Run and GKE Autopilot, the customer must manually patch runtime dependencies and manage physical host security, while Google manages application data classification.

Professional Cloud Security Engineer

Security Demarcation Iaas Paas Gke Cloud Run

Related questions