In the Infrastructure as a Service (IaaS) shared responsibility model, the Cloud Service Provider (CSP) is typically responsible for securing the physical infrastructure, which includes the physical security of data centers, servers, networking hardware, and the physical security controls that protect them from unauthorized access or damage.
Encrypting data at rest is typically the responsibility of the consumer, though the CSP may offer tools to help with this. Managing application code is the responsibility of the consumer, as they control and deploy the applications on the infrastructure provided by the CSP. Configuring firewall rules is also the responsibility of the consumer, as they manage the configuration of the virtual network, including security rules like firewalls.

An authoritative source in the context of identity management refers to a trusted system that contains accurate identity information. This system is considered the source of truth for identities, and other systems or services within the organization rely on it for the most up-to-date and verified identity details, such as usernames, attributes, roles, and permissions.
A list of permissions assigned to different users represents access control data but is not considered the authoritative source of identity. A network resource that handles authorization requests refers to authorization mechanisms but is not the authoritative source for identity. A database containing all entitlements could be part of an identity management system but is not necessarily the authoritative source for identity itself; it focuses more on access rights and entitlements.