Exercise 2: Why Provider Certification Doesn't Make the Customer Compliant — Possible Solution
====================================================================

The core reason, per the chapter, comes directly from Chapter 1's
shared responsibility model: compliance obligations, like security
obligations generally, split across the same "of the cloud" vs. "in
the cloud" line.

A provider's SOC 2/HIPAA/PCI DSS certification covers the PROVIDER's
own infrastructure and operational practices -- their physical data
center security, their internal processes, their own systems. This is
squarely the "of the cloud" half of the responsibility model, which
the provider genuinely does handle and can be independently certified
for.

But a customer's own application, built ON TOP of that certified
infrastructure, involves a whole separate set of decisions that are
entirely the CUSTOMER's to get right -- per the chapter: IAM policies
(Chapter 6), encryption settings (this chapter), and general data
handling practices. None of these are things the provider's own
certification audits or covers, because the provider has no visibility
into or control over how a specific customer configures their own
resources on top of the platform.

Concretely: a provider can be genuinely, fully HIPAA-compliant in how
it operates its own data centers, while a specific customer's
application running on that provider is NOT HIPAA-compliant, because
that customer left a storage bucket publicly readable (Chapter 1's own
exercise 2 scenario), used overly broad IAM policies, or never enabled
encryption on a database containing sensitive health data. The
provider's certification simply doesn't reach into any of those
customer-controlled decisions at all.

WHY THIS WORKS AS AN ANSWER
------------------------------
This directly applies Chapter 1's shared responsibility model -- the
same framework this chapter uses throughout -- to the specific claim
being evaluated, showing that "provider is certified" and "customer's
configuration is compliant" are answers to two DIFFERENT questions,
covering two different halves of the same responsibility split, rather
than the same question asked twice.