Certified Ethical Hacker (CEH) Practice Question

In an IaaS model, the cloud provider secures the physical facilities, networking, and hypervisor layers that make up the underlying cloud infrastructure. The customer, however, is responsible for security in the cloud, which includes protecting data, managing identity and access, configuring virtual firewalls, and applying controls inside guest operating systems. Encrypting data stored in virtual machine block storage volumes (for example, Amazon EBS) falls squarely under the customer's domain, so a penetration tester can and should evaluate how well that data is protected. Physical site security, hypervisor patching, and datacenter power or cooling are managed solely by the provider and are therefore out of scope for a customer-side assessment.