Examkin

Question

Difficulty: MediumCloud Architecture and Deployment Models

A logistics company migrates its core inventory database to a public cloud Infrastructure as a Service (IaaS) environment using custom virtual machine instances. Under the cloud shared responsibility model, which of the following tasks is the sole operational security responsibility of the customer enterprise?

  1. Applying operating system security updates and configuring host-based firewalls on virtual machinesAnswer
  2. B
    Upgrading hypervisor software versions and replacing failing physical disk arrays in storage racks
  3. C
    Configuring network perimeter firewalls to grant implicit trust to all internal subnet traffic
  4. D
    Executing user identity authentication protocols when assigning object file access permissions

Answer

Applying operating system security updates and configuring host-based firewalls on virtual machines is the sole operational security responsibility of the customer enterprise.
In Infrastructure as a Service (IaaS), the cloud provider is responsible for securing the underlying physical infrastructure, virtualization hypervisors, and data center facilities. The customer enterprise retains total administrative responsibility for everything running above the hypervisor layer, including installing, patching, and hardening guest operating systems, as well as managing host-based network controls.

Step-by-Step Solution

1
Identify the cloud service model referenced in the enterprise scenario
The scenario specifies an Infrastructure as a Service (IaaS) deployment model.
Security responsibilities vary depending on whether IaaS, PaaS, or SaaS is implemented.
2
Differentiate shared responsibility boundaries between the Cloud Service Provider (CSP) and the customer for IaaS
The CSP manages physical data centers, physical hardware, power, facility security, and hypervisors. The customer manages guest operating systems, application code, data classification, and virtual network configuration.
IaaS provides raw compute and storage infrastructure, leaving operating system control with the tenant.
3
Select the task aligned with customer-managed IaaS responsibilities
Guest operating system security patching and host firewall configuration fall directly on the customer enterprise.
The CSP cannot access or modify the internal guest OS software stack managed by the customer without explicit tenant access.

Key Concept

Cloud Shared Responsibility Model (IaaS)
Rate this question

Topics

Cloud Architecture and Deployment Models

More questions from this topic