Examkin

Question

Difficulty: MediumCloud Architecture and Deployment Models

An enterprise security team is implementing a Platform as a Service (PaaS) managed container environment to host web microservices. Under the shared responsibility model, the Cloud Service Provider (CSP) maintains the underlying hardware, hypervisors, and orchestrator control plane. Which of the following operational tasks remains the primary responsibility of the enterprise security team?

  1. Configuring application-level access controls and remediating vulnerabilities in custom container image code.Answer
  2. B
    Applying firmware updates and OS security patches to the physical server nodes hosting the cluster.
  3. C
    Implicitly trusting all inter-service network traffic routing within the private virtual cloud subnet.
  4. D
    Utilizing authentication protocols to specify granular data modification permissions for authenticated users.

Answer

Configuring application-level access controls and remediating vulnerabilities in custom container image code is the primary responsibility of the customer enterprise.
Under the cloud shared responsibility model for Platform as a Service (PaaS), the cloud service provider manages the physical infrastructure, network layer, hypervisor, and container orchestrator engine. The customer remains responsible for application code security, data classification, and access control configuration.

Step-by-Step Solution

1
Analyze the cloud service model specified in the scenario.
The scenario describes a Platform as a Service (PaaS) environment where container orchestration and physical infrastructure are managed by the Cloud Service Provider.
Understanding the service model boundaries determines the baseline division of duties under the shared responsibility model.
2
Differentiate between provider-managed responsibilities and customer-managed responsibilities for PaaS.
The CSP manages physical facility security, hypervisor updates, host OS patching, and control plane orchestration. The customer manages application code, runtime configurations, identity governance, and customer data security.
PaaS offloads hardware and system administration tasks to the CSP while leaving application security with the tenant.
3
Select the option representing customer-side responsibilities.
Application access controls and container image code security belong to the customer domain.
Customers retain ownership and accountability for data, identity governance, and custom application code regardless of cloud service model.

Key Concept

Cloud Shared Responsibility Model in PaaS Environments
Estimated Time:1m 30s
Rate this question

Topics

Cloud Architecture and Deployment Models

More questions from this topic