While AI improves threat detection, it also introduces risks as attackers can use it to develop advanced attack methods. Organizations must balance these risks. Reference: [CCSK Study Guide, Domain 12 - AI and Security]

Using IAM roles/identities provided by cloud providers instead of static secrets (like passwords or API keys) significantly reduces the risk of credential leakage. IAM roles enable dynamic and temporary credentials, meaning that they are automatically rotated and do not need to be manually stored or managed. This eliminates the need for hardcoding sensitive credentials into code or configuration files, which can often lead to accidental exposure or misuse if not properly secured.
Lowering storage costs is not a direct benefit of using IAM roles over static secrets. Facilitating data encryption is important for security, but IAM roles are not specifically focused on data encryption. Improving system performance is not a primary benefit of using IAM roles over static secrets. The main advantage is security-related, specifically the reduction in credential leakage risks.

In a cybersecurity environment, it is important to capture and centralize workload logs promptly because logs may be lost during a scaling event. When workloads are scaled up or down, such as when cloud resources are dynamically allocated, logs may not be properly captured or may be overwritten if they are not centralized and stored in a reliable, persistent location. Centralizing logs ensures that valuable security data is not lost during these events and can be accessed for incident detection, analysis, and response.

In Infrastructure as a Service (IaaS), the customer has the most control and security responsibility because:
* The provider only secures physical infrastructure (data centers, networking, hardware).
* Customers must configure and manage firewalls, network security, operating system patches, and IAM.
* Data security, encryption, and application security are entirely the customer's responsibility.
In contrast:
* PaaS (Platform as a Service) places some security responsibility on the provider (e.g., runtime environments, managed databases).
* SaaS (Software as a Service) places most security responsibility on the provider, with customers mainly managing identity and access controls.
This is extensively discussed in:
* CCSK v5 - Security Guidance v4.0, Domain 1 (Cloud Computing Concepts and Architectures)
* Cloud Controls Matrix (CCM) - Infrastructure and Application Security Controls.