Cloud Characteristics and Shared Security Model
Key Takeaways
Subdomain 4.3 names five cloud characteristics: broad network access, rapid elasticity, measured service, on-demand self-service, and resource pooling.
Each characteristic has a security implication for access, monitoring, provisioning, or isolation.
The shared security model defines the roles and responsibilities of the customer and the cloud service provider.
Service models and deployment models are separate subtopics of 4.3 and are studied alongside the characteristics.
Source: ISC2 CC Exam Outline v01/2026, subdomain 4.3, checked 2026-10-22.
Cloud Characteristics Named in the Outline
Subdomain 4.3, Understand cloud security, lists characteristics that a candidate must recognize: broad network access, rapid elasticity, measured service, on-demand self-service, and resource pooling. The outline asks candidates to recognize these characteristics and to link them to security decisions.
Source: ISC2 Certified in Cybersecurity Exam Outline, effective September 1, 2026 (v01/2026), subdomain 4.3, checked 2026-10-22.
Characteristics and Their Security Implications
| Characteristic | Plain meaning | Security implication |
|---|---|---|
| Broad network access | Services are reachable over the network from many kinds of device | Protect connections and endpoints, not only the data center edge |
| Rapid elasticity | Capacity scales up and down quickly | Access and configuration rules must keep pace, and automatic scaling can create new resources that need review |
| Measured service | Usage is metered and reported | Usage records and logs help monitor use and spot unexpected consumption |
| On-demand self-service | Users provision resources without asking the provider | Provisioning rules must control who can create resources and with what access |
| Resource pooling | The provider serves several customers from shared infrastructure | Isolation between customers and the shared security model matter |
Connecting Characteristics to the Shared Security Model
The outline pairs the characteristics with the shared security model, which defines the roles and responsibilities between the organization and the cloud service provider (subdomain 4.3). A candidate who knows that resource pooling means a shared environment, and that self-service provisioning is controlled by the customer, can answer which party owns a given control.
The service-model material elsewhere in this chapter covers the responsibility split in more detail.
Scenario: Self-Service Without a Review Step
A developer creates a new cloud storage resource in minutes through self-service. Weeks later it holds customer records, and nobody has reviewed who can access it. On-demand self-service is a normal characteristic; the failure is that provisioning did not require review. The fix is an approval or policy check built into provisioning, which is a control under subdomain 3.1 (provisioning and review).
A customer adds capacity to a cloud service during a traffic spike and removes it afterward. Which characteristic describes this?
Rapid elasticity
Measured service
Resource pooling
Broad network access
Match each cloud characteristic to its plain meaning.
Match each item on the left with the correct item on the right
Broad network access
Measured service
Resource pooling
Sections you finish are checked off in the contents.