Examkin

Question

Difficulty: HardCloud Architecture and Deployment Models

An online gaming enterprise is transitioning its matchmaking service to a cloud provider's Function-as-a-Service (FaaS) event-driven architecture integrated with a managed API Gateway. As part of establishing the enterprise cloud security baseline, the lead architect must define operational boundaries under the shared responsibility model. Which of the following tasks remain the sole responsibility of the enterprise customer? (Select TWO.)

  1. Auditing and remediation of application source code vulnerabilities and third-party software dependenciesAnswer
  2. B
    Applying security patches and kernel updates to the host operating system executing the serverless functions
  3. Configuring least-privilege Identity and Access Management (IAM) execution roles and API Gateway authorization policiesAnswer
  4. D
    Maintaining physical security and environmental controls for the facility infrastructure hosting the compute clusters

Answer

The enterprise customer is responsible for auditing application source code and third-party dependencies, as well as configuring least-privilege IAM execution roles and API Gateway authorization policies.
In Function-as-a-Service (FaaS) models, the cloud provider abstracts away servers, operating systems, and physical infrastructure. However, the enterprise customer remains strictly responsible for everything inside their code (such as vulnerability scanning, fixing code bugs, and auditing third-party libraries) and for identity controls (such as defining granular IAM execution roles for functions and configuring access rules at the API Gateway).

Step-by-Step Solution

1
Analyze the cloud service model presented in the scenario.
The scenario uses a Function-as-a-Service (FaaS / Serverless) deployment model combined with a managed API Gateway.
Service models dictate how operational responsibilities are allocated between the Cloud Service Provider (CSP) and the customer.
2
Differentiate CSP-managed infrastructure components from customer-managed configuration and data components in FaaS.
The CSP manages physical hardware, hypervisors, runtime engines, and host OS patching. The customer retains control over application code, data, and access configurations.
Serverless abstracts away server administration, removing host OS maintenance and hardware security from the customer's purview.
3
Evaluate each option against the customer's responsibilities.
Remediating application code flaws and defining IAM/API access policies are customer tasks. OS kernel patching and data center physical controls are CSP tasks.
Security in the cloud requires customers to secure their data, code logic, and access permissions, regardless of abstraction level.

Key Concept

Cloud Shared Responsibility Model in Serverless (FaaS) Architectures
Rate this question

Topics

Cloud Architecture and Deployment Models

More questions from this topic