Examkin

Question

Difficulty: MediumCloud Architecture and Deployment Models

Match each organizational security management requirement to the cloud service model where the customer retains primary operational responsibility for implementing that control.

  • Configuring guest operating system firewall rules and applying OS security patches on virtual machine instances.Infrastructure as a Service (IaaS)
  • Managing application source code security and configuring database user authorization schemas in a managed database environment.Platform as a Service (PaaS)
  • Configuring user access permissions, multi-factor authentication policies, and data classification tags within a hosted enterprise email service.Software as a Service (SaaS)
  • Writing stateless function code and configuring execution trigger bindings without managing container runtimes or underlying OS hosts.Function as a Service (FaaS / Serverless)

Answer

Under the cloud shared responsibility model: OS patching and host firewall configuration fall under Infrastructure as a Service (IaaS); application code and database schema management fall under Platform as a Service (PaaS); identity governance, access policies, and data classification in hosted applications fall under Software as a Service (SaaS); and stateless function logic with trigger permissions falls under Function as a Service (FaaS / Serverless).
Each deployment model dictates a different division of security controls between cloud service providers (CSPs) and enterprise tenants according to the cloud shared responsibility framework. Moving from IaaS to PaaS, SaaS, and FaaS progressively shifts infrastructure, OS, and runtime platform operational duties to the provider, while data governance and identity authorization remain customer responsibilities across all service models.

Step-by-Step Solution

1
Analyze the scope of responsibility for guest operating systems and network firewalls.
Identify that managing OS patches and guest firewalls requires access at the OS abstraction layer, placing responsibility on the customer in IaaS.
IaaS provides raw compute resources where the provider handles physical and hypervisor layers, leaving OS administration to the tenant.
2
Evaluate the management boundary for database schema configurations and application code on managed platforms.
Determine that application logic and database schema permissions fall under PaaS customer responsibilities.
PaaS abstracts the underlying OS and database engine maintenance, allowing customers to focus on custom code and data schema security.
3
Assess enterprise user access control and data classification in hosted email applications.
Map hosted end-user application identity and data access controls to SaaS.
SaaS providers manage the entire application infrastructure, leaving only data access, identity management, and endpoint security to the customer.
4
Identify event-driven stateless function execution security responsibilities.
Match function logic and trigger configurations to FaaS / Serverless.
FaaS eliminates container and server administration for the customer, isolating their responsibility to the uploaded code and trigger events.

Key Concept

Cloud Shared Responsibility Model Across Service Delivery Models
Rate this question

Topics

Cloud Architecture and Deployment Models

More questions from this topic