Examkin

Question

Difficulty: Very hardCloud Architecture and Deployment Models

A digital media broadcasting network is migrating its video processing pipeline to a cloud-native architecture using a serverless Function-as-a-Service (FaaS) compute layer paired with object storage for asset ingestion. The security engineering team must establish governance over operational tasks according to the cloud shared responsibility model. Which TWO of the following operational tasks remain the sole security responsibility of the broadcasting network?

  1. Managing resource access policies and Identity and Access Management (IAM) permissions for stored video assetsAnswer
  2. Validating, sanitizing, and patching vulnerabilities within the custom application code and integrated libraries loaded into the functionsAnswer
  3. C
    Applying security patches and underlying updates to the host operating system and container engine executing the serverless functions
  4. D
    Configuring network perimeter firewalls and physical hardware isolation across the physical data centers hosting the infrastructure

Answer

Managing resource access policies and IAM permissions for stored video assets, along with validating and patching custom application code and third-party dependencies deployed into serverless functions, remain the sole security responsibility of the enterprise customer.
Under the cloud shared responsibility model for serverless (FaaS) and managed object storage environments, the Cloud Service Provider (CSP) abstracts and manages the underlying host infrastructure, operating system, container runtime execution layer, and physical security. However, data governance, identity and access management (IAM) policy definition, and the security of application code (including code sanitization and third-party dependency vulnerabilities) remain strictly the responsibility of the customer.

Step-by-Step Solution

1
Analyze the cloud service model referenced in the scenario.
The infrastructure uses Function-as-a-Service (FaaS / Serverless) compute and object storage.
Determining the service model establishes the boundaries between customer and provider responsibilities.
2
Differentiate between CSP infrastructure responsibilities and customer operational responsibilities in FaaS.
The CSP manages host OS, hypervisor, runtime engine, physical hardware, and facility security. The customer manages data classification, IAM access rules, and application code security.
FaaS abstracts server and container administration away from the customer, but code logic and access governance never shift to the cloud vendor.
3
Select the responsibilities attributable exclusively to the customer.
Configuring IAM access policies for stored data assets and securing customer-written code and dependencies are the two customer duties.
These tasks directly safeguard customer-owned assets and data within the shared responsibility matrix.

Key Concept

Shared Responsibility Model in Serverless (FaaS) Architectures
Rate this question

Topics

Cloud Architecture and Deployment Models

More questions from this topic