Examkin

Question

Difficulty: MediumCloud Architecture and Deployment Models

A financial technology company is deploying a novel microservice-based payment gateway using a Cloud Service Provider's (CSP) managed Serverless (Function-as-a-Service) platform and managed API gateway. Under the cloud shared responsibility model, which of the following security tasks are the EXCLUSIVE responsibility of the enterprise customer? (Select TWO.)

  1. Scanning third-party application dependencies and sanitizing custom code against vulnerabilitiesAnswer
  2. Configuring granular Identity and Access Management (IAM) role permissions for the function execution environmentAnswer
  3. C
    Applying security patches and kernel updates to the underlying serverless container host operating system
  4. D
    Deploying physical network perimeter firewalls and hardware intrusion prevention systems around the compute cluster

Answer

The customer is exclusively responsible for scanning application dependencies and sanitizing custom code, as well as configuring granular IAM role permissions for function execution environments.
In a Serverless (FaaS) model, the cloud provider handles all underlying infrastructure, including physical servers, hypervisors, host operating systems, and runtime environments. The customer retains full responsibility for their application layer—including source code security, third-party library scanning, input validation—and configuration management, such as defining least-privilege IAM execution roles.

Step-by-Step Solution

1
Analyze the cloud deployment model specified in the scenario
Identified Serverless / Function-as-a-Service (FaaS) architecture.
Serverless architectures abstract server management, OS maintenance, and physical network infrastructure away from the customer.
2
Evaluate the division of responsibility under the shared responsibility model for FaaS
The CSP manages physical security, host OS patching, hypervisors, and serverless runtime environments. The customer manages application code logic, dependencies, data classification, and access control (IAM).
Determines which operations belong to the customer versus the provider.
3
Select the tasks that fall solely under customer governance
Application code security/dependency scanning and IAM role policy configuration.
Both represent customer-side responsibility in serverless cloud environments.

Key Concept

Cloud Shared Responsibility Model in Serverless (FaaS) Architectures
Rate this question

Topics

Cloud Architecture and Deployment Models

More questions from this topic