Examkin

Question

Difficulty: HardCloud Architecture and Deployment Models

A healthcare software provider hosts its primary electronic health record (EHR) database within an on-premises data center while leveraging a public cloud Infrastructure as a Service (IaaS) environment for high-throughput batch analytics. The environments are linked via a dedicated direct network connection. During a security baseline review of the public cloud IaaS infrastructure, the security architect must clarify operational duties under the cloud shared responsibility model. Which of the following security controls remains the sole responsibility of the healthcare software provider within the public cloud IaaS segment?

  1. Applying security patches to guest operating systems and configuring virtual instance firewall rules.Answer
  2. B
    Updating physical server firmware and patching underlying hypervisors across availability zones.
  3. C
    Implicitly trusting all network traffic arriving over the dedicated connection without requiring microsegmentation.
  4. D
    Delegating identity verification and role-based application data authorization to the cloud service provider's physical security team.

Answer

Applying security patches to guest operating systems and configuring virtual instance firewall rules is the sole responsibility of the cloud customer in an IaaS environment.
In Infrastructure as a Service (IaaS), the cloud provider guarantees the availability and security of the physical infrastructure, facility, storage hardware, and hypervisor virtualization layer. The customer maintains full operational control—and security obligation—over the guest operating systems, installed applications, data classification, identity management, and virtual networking rules (such as instance firewalls and security groups).

Step-by-Step Solution

1
Identify the cloud deployment and service model described in the scenario.
The architecture uses a hybrid deployment model integrating on-premises facilities with public cloud Infrastructure as a Service (IaaS).
The shared responsibility matrix differs significantly depending on whether the service model is IaaS, PaaS, or SaaS.
2
Analyze the distribution of duties between the Cloud Service Provider (CSP) and the customer under IaaS.
The CSP manages physical security, hardware infrastructure, storage facilities, and hypervisor virtualization layers. The customer manages guest operating systems, application stacks, data protection, access controls, and network configurations.
IaaS provides raw compute resources, placing OS maintenance and logical network boundaries under customer ownership.
3
Evaluate the options against the customer responsibility boundary.
Guest OS patching and virtual firewall configurations sit squarely on the customer side of the responsibility line.
The CSP does not have administrative access inside customer virtual machine operating systems.

Key Concept

Cloud Shared Responsibility Model in Infrastructure as a Service (IaaS)
Rate this question

Topics

Cloud Architecture and Deployment Models

More questions from this topic