A team moves an application to Compute Engine and assumes Google now manages all application permissions and operating-system patches. What should a cloud leader explain?

1. Shared responsibility removes the need for security monitoring
2. Security responsibilities are shared; the customer still manages relevant guest OS, application, and access controls
3. The provider automatically owns every application security decision
4. The customer becomes responsible for Google’s physical data-center security