Examkin

Question

Difficulty: Very hardCloud Architecture and Deployment Models

An enterprise financial organization is designing a hybrid cloud connectivity model for an analytics workload that dynamically offloads data processing from on-premises servers to a public cloud Platform as a Service (PaaS) environment. Security policy mandates that data in transit must never traverse the public internet, data endpoints must not expose public IP addresses, and customer responsibility must be limited strictly to application logic, data classification, and access policies without host management overhead. Which of the following architecture designs and responsibility allocations best fulfills these requirements?

  1. Establish a dedicated private connection with private endpoint interfaces for cloud services; under PaaS, the provider secures the underlying host infrastructure and platform orchestrator, while the organization manages database access control and data security.Answer
  2. B
    Configure an encrypted site-to-site IPsec VPN connecting to public service endpoints, requiring the cloud provider to manage both the guest operating system security and customer access policy configurations.
  3. C
    Deploy a dedicated private line connection to the cloud region while trusting all inbound internal network traffic without endpoint microsegmentation, placing total responsibility for container execution runtime isolation on customer network firewalls.
  4. D
    Provision an Infrastructure as a Service (IaaS) host cluster with public endpoints, relying on the cloud service provider to perform guest operating system patching and host container hardening.

Answer

Establish a dedicated private connection with private endpoint interfaces for cloud services; under PaaS, the provider secures the underlying host infrastructure and platform orchestrator, while the organization manages database access control and data security.
Establishing a dedicated private network connection combined with private endpoints guarantees that network traffic stays off the public internet and does not use public IP addresses. In a PaaS deployment model, the cloud provider manages the underlying infrastructure, operating system, and container runtime environments, while the customer maintains responsibility for data classification, encryption, and access control governance.

Step-by-Step Solution

1
Analyze connectivity requirements.
Requirements specify that traffic must never traverse the public internet and public IPs must not be exposed.
Dedicated private connectivity (such as Direct Connect or ExpressRoute) coupled with private endpoint technologies (such as PrivateLink) ensures private IP routing directly into the cloud infrastructure.
2
Evaluate the cloud service model (PaaS) boundaries.
PaaS shifts infrastructure, hypervisor, OS, and runtime management to the Cloud Service Provider (CSP).
The customer remains responsible only for identity and access management, application logic, and data protection/classification.
3
Synthesize connectivity and responsibility model.
The architecture combining private line endpoints with PaaS shared responsibility fulfills both isolation and minimal operational overhead demands.
This combination isolates traffic at the network layer while restricting customer administrative overhead to application and data security controls.

Key Concept

PaaS Shared Responsibility and Private Cloud Connectivity
Estimated Time:2m 0s
Rate this question

Topics

Cloud Architecture and Deployment Models

More questions from this topic