Examkin

Question

Difficulty: MediumCloud Architecture and Deployment Models

A financial organization is migrating an existing legacy internal application to a public Infrastructure as a Service (IaaS) environment. Under the cloud shared responsibility model, which of the following security management tasks are the direct responsibility of the organization? (Select TWO.)

  1. Patching operating system vulnerabilities on deployed virtual instancesAnswer
  2. Configuring network access rules and host-based firewalls on virtual serversAnswer
  3. C
    Updating hypervisor firmware across physical host hardware servers
  4. D
    Maintaining physical access security and environmental controls for the cloud data center

Answer

The organization is responsible for patching operating system vulnerabilities on deployed virtual instances and configuring network access rules and host-based firewalls on virtual servers.
In an Infrastructure as a Service (IaaS) cloud architecture, the cloud service provider (CSP) takes responsibility for securing physical data centers, host hardware, and hypervisors. The customer assumes responsibility for securing the guest operating systems (including applying OS patches) and managing access traffic through virtual firewall configurations and host-based security rules.

Step-by-Step Solution

1
Identify the cloud deployment and service model described in the scenario
The scenario specifies an Infrastructure as a Service (IaaS) public cloud environment.
Responsibility boundaries vary significantly based on whether IaaS, PaaS, or SaaS is deployed.
2
Determine the cloud provider versus customer responsibilities in IaaS
The cloud service provider manages physical facilities, hardware, network infrastructure, and hypervisors. The customer manages guest operating systems, application code, data classification, and virtual network configuration.
Under the shared responsibility model for IaaS, control of everything above the hypervisor layer is retained by the tenant.
3
Select the correct security controls assigned to the customer
Operating system security patching and host-based firewall configurations fall squarely within customer management, whereas hypervisor firmware updates and physical security belong to the provider.
Distinguishing between underlying cloud infrastructure management and tenant server configuration establishes correct operational control boundaries.

Key Concept

Shared Responsibility Model in IaaS Cloud Architecture
Estimated Time:1m 30s
Rate this question

Topics

Cloud Architecture and Deployment Models

More questions from this topic