A educational institution transitions its student portal from an on-premises data center to a public cloud Infrastructure as a Service (IaaS) environment. The portal runs on enterprise Linux virtual machine instances provisioned within the cloud provider's Virtual Private Cloud (VPC). Under the cloud shared responsibility model, which of the following security management tasks remains the sole responsibility of the institution's security team?
- AApplying firmware updates to the underlying physical servers and hypervisors hosting the virtual instances
- Configuring and maintaining security updates for the guest operating systems running on the virtual instancesAnswer
- CTrusting all incoming network traffic originated from within the virtual private cloud boundaries automatically
- DUsing authentication services to define granular authorization access permissions for database records
Answer
Configuring and maintaining security updates for the guest operating systems running on the virtual instances is the exclusive responsibility of the cloud customer in an Infrastructure as a Service (IaaS) model.
In Infrastructure as a Service (IaaS), the cloud provider is responsible for the security 'of' the cloud (physical hosts, facilities, hypervisors, and hardware network devices), while the customer is responsible for security 'in' the cloud (guest operating systems, middleware, installed software, database configurations, and firewalls). Therefore, updating and configuring the guest OS is the responsibility of the customer.
Step-by-Step Solution
Key Concept
Cloud Shared Responsibility Model in Infrastructure as a Service (IaaS)
Estimated Time:1m 0s