Examkin

Question

Difficulty: HardCloud Architecture and Deployment Models

A global retail organization is transitioning its legacy transaction processing platform to a hybrid cloud deployment model. The architecture uses Infrastructure as a Service (IaaS) to host legacy relational database instances and Platform as a Service (PaaS) to host modern containerized web frontends. During a cloud architecture security review, the lead security engineer must define operational boundaries under the Shared Responsibility Model for both service types. Which of the following security management tasks remain the exclusive responsibility of the organization across BOTH the IaaS database instances and PaaS web frontends? (Select TWO.)

  1. Classifying application-layer data assets and configuring data access authorization controlsAnswer
  2. B
    Applying firmware updates and hypervisor patch management to physical server infrastructure
  3. Configuring Identity and Access Management (IAM) role permissions and API access credentials for application usersAnswer
  4. D
    Patching the underlying virtual machine operating system kernel hosting the web server runtime environment

Answer

Classifying application-layer data assets and configuring data access authorization controls, along with configuring Identity and Access Management (IAM) role permissions and API access credentials for application users, are tasks exclusively retained by the cloud customer in both IaaS and PaaS environments.
In the cloud Shared Responsibility Model, data management (including data classification, payload security, and access rules) and Identity and Access Management (IAM identity lifecycle and privilege assignment) are customer responsibilities regardless of whether the model is IaaS, PaaS, or SaaS. Therefore, classifying application data assets and configuring IAM permissions for API endpoints are customer-managed duties across both environments.

Step-by-Step Solution

1
Analyze the IaaS responsibility scope
In IaaS, the cloud customer manages the operating system, runtime, middleware, data, and access configurations, while the provider manages physical facilities, hardware, and hypervisors.
Establishing customer baseline responsibilities for the database instances.
2
Analyze the PaaS responsibility scope
In PaaS, the provider assumes responsibility for the underlying operating system, middleware, and database engines/runtimes, leaving the customer responsible for application code, data classification, and IAM policies.
Identifying which tasks shift to the cloud provider when moving from IaaS to PaaS.
3
Determine overlapping customer responsibilities across both models
Data governance/classification and Identity and Access Management (IAM) permissions remain customer duties in both service models, whereas OS kernel patching shifts to the provider in PaaS.
Selecting the two options that are exclusively customer-managed in both IaaS and PaaS.

Key Concept

Shared Responsibility Model boundaries across IaaS and PaaS cloud service models
Estimated Time:2m 0s
Rate this question

Topics

Cloud Architecture and Deployment Models

More questions from this topic