Examkin

Question

Difficulty: MediumCloud Architecture and Deployment Models

An enterprise security architect is evaluating cloud operational boundaries across various enterprise environments. Match each cloud service or deployment model scenario on the left with the corresponding customer security management responsibility on the right.

  • Infrastructure as a Service (IaaS) instance hosting custom line-of-business applicationsManaging guest operating system security patches, network firewall rules, middleware, and application stack vulnerabilities.
  • Platform as a Service (PaaS) managed container environmentSecuring application source code, data schema access, and API authentication, while relying on the provider for underlying OS and runtime maintenance.
  • Software as a Service (SaaS) cloud communication and productivity portalConfiguring identity access controls, user provisioning, and data classification governance while relying on the provider for application software and platform infrastructure.
  • On-premises Private Cloud infrastructure hosting legacy databasesRetaining total administrative control over all physical facilities, hardware, hypervisors, network perimeters, and guest workloads.

Answer

In IaaS, the customer manages the guest OS, host firewalls, and application stack. In PaaS, the customer manages application code and access controls while the provider manages the OS and runtime engine. In SaaS, the provider manages the application and infrastructure while the customer manages user access and data governance. In a Private Cloud, the enterprise manages all physical infrastructure, hypervisors, and virtual workloads.
Each cloud service model defines a distinct boundary of ownership. In IaaS, hardware virtualization is provided by the CSP while OS patching, host firewalls, and application management remain customer duties. In PaaS, the CSP manages the OS and runtime environment, while the customer manages code and application access. In SaaS, the CSP manages the full application stack while the customer manages identities and data classification. In a private cloud on-premises setup, the enterprise retains end-to-end control of physical and virtual assets.

Step-by-Step Solution

1
Analyze the IaaS deployment model requirements.
Identify that IaaS leaves the guest operating system, network firewall configurations, and application security under customer administration.
IaaS provides raw virtualized hardware and storage, meaning OS administration remains with the tenant.
2
Evaluate PaaS service boundary expectations.
Determine that PaaS hides the OS management layer from the customer, focusing customer responsibility on custom code and data schema controls.
PaaS abstracts operating system execution environments so developers can focus purely on application delivery.
3
Distinguish SaaS operational limits.
Map SaaS to user identity management, credential governance, and data security policies.
SaaS providers deliver completed application functionality, eliminating customer maintenance of application binaries or platform software.
4
Differentiate Private Cloud infrastructure responsibilities.
Confirm complete organization ownership over hardware, physical controls, and virtualization layers.
Private clouds deployed on-premises do not transfer facility or physical infrastructure management to a third party.

Key Concept

Cloud Shared Responsibility Model and Cloud Deployment Model Boundaries
Rate this question

Topics

Cloud Architecture and Deployment Models

More questions from this topic