Examkin

Question

Difficulty: MediumCloud Architecture and Deployment Models

A healthcare organization is deploying a patient engagement application using virtual machine instances hosted on an Infrastructure as a Service (IaaS) cloud platform. The security architect is defining the operational security responsibilities between the organization and the cloud service provider (CSP). According to the cloud shared responsibility model, which of the following tasks is the sole responsibility of the customer?

  1. Configuring security baselines and applying security patches to the guest operating systemsAnswer
  2. B
    Updating and patching the hypervisor layer that isolates multi-tenant virtual machines
  3. C
    Treating all network traffic originating within the cloud provider's internal subnet as implicitly trusted
  4. D
    Maintaining physical security controls and environmental systems for the host datacenters

Answer

Configuring security baselines and applying security patches to the guest operating systems
In Infrastructure as a Service (IaaS) cloud deployments, operational responsibility for everything built above the hypervisor belongs to the customer. This includes configuring guest operating systems, installing OS patches, managing installed applications, and implementing network access control lists on virtual interfaces.

Step-by-Step Solution

1
Identify the cloud service model referenced in the scenario.
The scenario specifies an Infrastructure as a Service (IaaS) deployment model.
Operational responsibility boundaries vary depending on whether IaaS, PaaS, or SaaS is deployed.
2
Differentiate customer duties from cloud service provider duties under IaaS.
The provider manages the physical infrastructure, facilities, hardware, and hypervisor layer. The customer manages the guest OS, middleware, applications, network firewall rules, and data.
The shared responsibility model defines ownership of security controls across cloud service tiers.
3
Evaluate the listed tasks against the customer's operational boundary.
Hardening and patching virtual machine guest operating systems falls directly within the customer's domain of control.
The CSP does not have administrative access or ownership of tenant-provisioned guest operating systems.

Key Concept

Cloud Shared Responsibility Model in Infrastructure as a Service (IaaS)
Rate this question

Topics

Cloud Architecture and Deployment Models

More questions from this topic