Examkin

Question

Difficulty: HardPlatform as a Service (PaaS)

A company deploys a web application to Azure App Service and a database to Azure SQL Database. During a security audit, the following vulnerabilities are identified:
1. The application code is vulnerable to SQL injection attacks.
2. The database connection strings are stored in plain text in the application configuration file.
3. The database firewall is configured to allow all inbound IP addresses.

Under the Azure shared responsibility model for Platform as a Service (PaaS) deployments, who is responsible for resolving these security findings?

  1. The company is responsible for resolving all three security findings.Answer
  2. B
    Microsoft is responsible for fixing the application vulnerability and securing the connection strings, while the company is responsible for configuring the database firewall.
  3. C
    Microsoft is responsible for resolving all three security findings because Azure SQL Database and Azure App Service are fully managed services.
  4. D
    The company is responsible for fixing the application vulnerability and securing the connection strings, while Microsoft is responsible for securing the database firewall.

Answer

The company is responsible for resolving all three security findings.
The customer is responsible for resolving all three findings. In a Platform as a Service (PaaS) deployment, the cloud provider manages the physical infrastructure, virtualization layer, and operating system. However, the customer retains full responsibility for their applications, database configurations, connection strings, and the network access controls (such as database firewall rules) configured on those resources.

Step-by-Step Solution

1
Identify the cloud deployment model.
Azure App Service and Azure SQL Database are Platform as a Service (PaaS) models.
Understanding the cloud service model is necessary to determine the division of security responsibilities under the shared responsibility model.
2
Evaluate the first finding (SQL injection vulnerability).
Application code security is the customer's responsibility in PaaS.
Microsoft manages the hosting environment but does not write, review, or secure the customer's application code.
3
Evaluate the second finding (plain-text connection strings).
Application configuration and credential management are the customer's responsibility in PaaS.
Securing application secrets, certificates, and connection strings (e.g., using Azure Key Vault) is a customer task.
4
Evaluate the third finding (open database firewall).
Configuring network access controls, such as firewall rules, is the customer's responsibility in PaaS.
PaaS providers supply the firewall capability, but the customer must configure the network security rules to restrict access.

Key Concept

Shared Responsibility Model in Platform as a Service (PaaS)
Estimated Time:1m 30s
Rate this question

Topics

Platform as a Service (PaaS)

More questions from this topic