Examkin

Question

Difficulty: Very hardCloud Architecture and Deployment Models

A Chief Information Security Officer (CISO) is auditing enterprise cloud services to enforce compliance with the cloud shared responsibility model across diverse architectures. Match each cloud service model implementation on the left to the corresponding primary security responsibility retained by the cloud customer on the right.

  • Infrastructure as a Service (IaaS) virtual server clusterManaging operating system configurations, guest firewall rules, application binaries, and middleware security patches.
  • Platform as a Service (PaaS) managed relational databaseConfiguring database user access rights, table-level encryption keys, and query logic, while relying on the provider for host OS and database engine patching.
  • Function as a Service (FaaS) event-driven microserviceWriting secure stateless code logic, defining trigger event bindings, and configuring granular IAM execution roles, while the provider manages runtime environment scaling.
  • Software as a Service (SaaS) cloud collaboration suiteConfiguring tenant user access controls, data loss prevention (DLP) rules, and identity federation settings, while the provider manages all software binaries and infrastructure.

Answer

Each cloud service model maps to a specific tier in the shared responsibility matrix based on the level of abstraction provided by the vendor. IaaS requires customer management of OS and networking firewall controls; PaaS requires customer management of data objects and access rights while delegating OS/engine patching to the vendor; FaaS leaves application code and identity execution context to the customer; SaaS limits customer control strictly to data governance, access controls, and policy configurations.
The mapping accurately reflects how responsibility shifts from customer-heavy in IaaS (OS, middleware, network controls) to provider-heavy in SaaS (entire application stack), with PaaS and FaaS delegating runtime and platform maintenance to the cloud provider while keeping data, code, and access governance under customer control.

Step-by-Step Solution

1
Analyze the IaaS virtual server cluster requirements.
IaaS provides bare compute infrastructure and virtualized host space, leaving OS patching, guest firewalls, and application management to the customer.
The provider only controls physical infrastructure and the hypervisor layer in IaaS.
2
Analyze the PaaS managed relational database requirements.
PaaS abstracts the underlying operating system and software engine, leaving database object access control and schema management to the customer.
The provider patches the host OS and DB engine, but cannot manage customer data access or application-level queries.
3
Analyze the FaaS event-driven microservice requirements.
FaaS abstracts both OS and runtime environments, requiring the customer to focus on secure function code and IAM execution roles.
Serverless architectures push infrastructure provisioning to the provider while keeping code and execution policy on the customer side.
4
Analyze the SaaS cloud collaboration suite requirements.
SaaS abstracts the entire hardware and software stack, leaving identity access, tenant settings, and data classification to the customer.
The vendor maintains all software and underlying platforms in SaaS deployments.

Key Concept

Cloud Shared Responsibility Matrix across IaaS, PaaS, FaaS, and SaaS
Rate this question

Topics

Cloud Architecture and Deployment Models

More questions from this topic