Examkin

Question

Difficulty: Very hardCloud Architecture and Deployment Models

A financial institution is refactoring a monolithic legacy application into a serverless Function-as-a-Service (FaaS) architecture managed via a public cloud provider's API gateway. The cloud provider maintains the underlying physical infrastructure, host hypervisors, and serverless execution runtimes. During an architecture security review, the lead security engineer must establish control placement and operational duties aligned with the cloud shared responsibility model and Zero Trust principles. Which of the following architectural strategies correctly defines the division of security responsibilities between the organization and the cloud provider?

  1. The organization is responsible for securing function code, configuring API gateway authorization policies, and defining IAM least-privilege execution roles, while the provider manages runtime container isolation, host OS patching, and physical infrastructure.Answer
  2. B
    The cloud provider automatically remediates code vulnerabilities within deployed custom functions and enforces application-level authorization, while the organization manages host hypervisor isolation and physical host maintenance.
  3. C
    The organization relies on the cloud provider's virtual network perimeter firewalls to implicitly trust internal function-to-function communication, removing the requirement for API access token verification or micro-segmentation.
  4. D
    The cloud provider's API gateway performs identity authentication, which automatically satisfies and guarantees all downstream function-level data authorization requirements without custom access control policies.

Answer

The organization is responsible for securing function code, configuring API gateway authorization policies, and defining IAM least-privilege execution roles, while the provider manages runtime container isolation, host OS patching, and physical infrastructure.
Under the cloud shared responsibility model for serverless (FaaS) deployments, the cloud service provider manages the physical facilities, server hardware, hypervisors, operating system patching, and function execution runtimes. The customer retains ownership and responsibility for their application code security, API gateway policy definition, data protection, and least-privilege Identity and Access Management (IAM) role scoping.

Step-by-Step Solution

1
Analyze the cloud service model
Identified the architecture as Function-as-a-Service (FaaS) integrated with an API gateway.
The service model dictates where the provider's management ends and the customer's governance begins.
2
Delineate shared responsibility boundaries for FaaS
The provider abstracts the hardware, host OS, container runtime, and hypervisors. The customer owns data, application code, API configuration, and identity/access management (IAM).
In serverless deployments, customers do not manage underlying servers or operating systems, but remain fully accountable for code security and access policies.
3
Apply Zero Trust and AAA principles
Verified that authentication at the gateway does not replace downstream fine-grained authorization, and perimeter trust must be rejected in favor of explicit verification.
Zero Trust mandates explicit verification across all microservice transactions.

Key Concept

Cloud Shared Responsibility Model in Serverless (FaaS) Architectures
Rate this question

Topics

Cloud Architecture and Deployment Models

More questions from this topic