Examkin

Question

Difficulty: HardCloud Architecture and Deployment Models

An enterprise security architect is establishing an operational governance framework for cloud adoption across multiple business units. Match each security administration task on the left with the primary responsible party under the cloud shared responsibility model on the right.

  • Configuring guest operating system security patches, local firewall rules, and custom kernel configurations on virtual computing instancesCustomer responsibility within Infrastructure as a Service (IaaS)
  • Securing application source code, managing API authentication keys, and configuring database schemas within a managed serverless platformCustomer responsibility within Platform as a Service (PaaS)
  • Managing user identity lifecycle, access permissions, multi-factor authentication enforcement, and data governance within a cloud-hosted productivity suiteCustomer responsibility within Software as a Service (SaaS)
  • Maintaining physical server hardware, facility perimeter controls, datacenter environmental monitoring, and hypervisor integrityCloud Service Provider (CSP) baseline responsibility across all deployment models

Answer

Guest OS configuration matches Customer responsibility in IaaS; Application and API security match Customer responsibility in PaaS; Identity and data governance match Customer responsibility in SaaS; Physical infrastructure and hypervisor maintenance match Cloud Service Provider baseline responsibility.
The cloud shared responsibility matrix defines operational boundaries based on service abstraction. Infrastructure as a Service requires customers to maintain everything above the hypervisor (including OS patching and host firewall rules). Platform as a Service offloads OS and runtime management to the vendor, leaving application code, API security, and database schemas with the customer. Software as a Service offloads full application maintenance, yet identity lifecycle and data protection remain customer duties. Physical datacenter facilities, hardware, and hypervisor security remain the provider's responsibility across all public cloud service models.

Step-by-Step Solution

1
Evaluate Infrastructure as a Service (IaaS) boundary
Determine that virtual machine OS configuration, kernel settings, and host firewalls fall on the subscriber side of the boundary.
IaaS provides raw compute infrastructure where the provider stops managing at the hypervisor layer.
2
Evaluate Platform as a Service (PaaS) boundary
Determine that managing code, API access tokens, and data schema falls to the subscriber.
PaaS abstracts compute and OS management, allowing subscribers to focus purely on application logic and dataset design.
3
Evaluate Software as a Service (SaaS) boundary
Determine that user authentication policies and data governance remain customer responsibilities.
Even when application hosting and infrastructure are completely managed by a vendor, data ownership and credential security never shift away from the customer.
4
Evaluate Cloud Service Provider baseline obligations
Identify physical datacenter security, power infrastructure, and hypervisor maintenance as universal provider duties.
The provider owns and manages the physical hardware and underlying virtualization layer supporting public cloud instances.

Key Concept

Cloud Shared Responsibility Model across Service Models (IaaS, PaaS, SaaS)
Rate this question

Topics

Cloud Architecture and Deployment Models

More questions from this topic