Examkin

Question

Difficulty: HardCloud Architecture and Deployment Models

An enterprise organization is migrating a mission-critical web service to a public cloud Infrastructure as a Service (IaaS) environment utilizing customer-managed virtual machines behind a cloud provider's network load balancer. Under the cloud Shared Responsibility Model, which of the following security functions remain the explicit responsibility of the enterprise security team? (Select TWO.)

  1. Configuring guest operating system security patches and host-based firewall policies on the deployed virtual machines.Answer
  2. Defining application data access controls and configuring customer-managed encryption for data stored within cloud volumes.Answer
  3. C
    Managing physical hardware maintenance and applying hypervisor security updates across the underlying cloud host infrastructure.
  4. D
    Trusting all internal network traffic between virtual machines without continuous authentication once cloud edge security groups are established.

Answer

The enterprise security team is responsible for configuring guest operating system patches and host firewalls, as well as managing application data access controls and storage volume encryption.
Under Infrastructure as a Service (IaaS), the cloud service provider manages the underlying physical facilities, hardware, and hypervisor abstraction layer. The customer retains explicit responsibility for configuring, patching, and securing everything above the hypervisor layer, including guest operating systems, host-based firewalls, identity permissions, and data encryption.

Step-by-Step Solution

1
Identify the cloud service model specified in the scenario
The scenario explicitly describes Infrastructure as a Service (IaaS) using customer-managed virtual machines.
Establishing the cloud service model (IaaS vs. PaaS vs. SaaS) defines the baseline operational division between the cloud provider and the enterprise.
2
Differentiate provider duties from customer duties in an IaaS architecture
The Cloud Service Provider (CSP) manages physical facilities, host hardware, power, physical networking, and hypervisors. The customer manages guest OS instances, network configuration within the virtual network, application code, data security, and IAM.
IaaS provides raw virtualized compute and storage, delegating everything above the hypervisor layer to the cloud customer.
3
Evaluate the candidate security duties against customer obligations
Guest OS patching, host firewalls, access permission definitions, and storage volume encryption are customer responsibilities.
Hypervisor management belongs to the provider, while relying solely on edge perimeters violates modern defense-in-depth and Zero Trust principles.

Key Concept

Cloud Shared Responsibility Model in Infrastructure as a Service (IaaS)
Rate this question

Topics

Cloud Architecture and Deployment Models

More questions from this topic