Examkin

Question

Difficulty: HardCloud Architecture and Deployment Models

A multinational technology company is migrating its customer analytics workloads to a managed Platform as a Service (PaaS) cloud architecture. Under this service model, the Cloud Service Provider (CSP) manages the physical hardware, hypervisors, database engine software, and underlying operating system runtime environments. The company's security engineering team must establish appropriate security architecture controls for the hosted applications and sensitive data. Under the cloud shared responsibility model, which of the following tasks remains the sole responsibility of the customer organization?

  1. A
    Applying security updates and kernel patches to the underlying database host operating systems.
  2. Configuring application-level access permissions, client data classification policies, and database user authorization schemas.Answer
  3. C
    Maintaining network perimeter firewall appliances surrounding the cloud provider's internal virtualized hypervisor infrastructure.
  4. D
    Authenticating infrastructure API calls made by the cloud provider's hypervisor automated maintenance scripts.

Answer

Configuring application-level access permissions, client data classification policies, and database user authorization schemas.
Under the cloud shared responsibility model for Platform as a Service (PaaS), the cloud service provider manages the physical data center, hardware infrastructure, hypervisor, and operating system runtime environment. The tenant organization retains full ownership and responsibility for securing its application code, user authorization configurations, data classification, and stored datasets.

Step-by-Step Solution

1
Analyze the cloud deployment model specified in the scenario.
The scenario describes a Platform as a Service (PaaS) deployment model.
Identifying the cloud model (PaaS) establishes the boundary line for shared responsibility between the CSP and the tenant.
2
Determine the cloud service provider's operational duties under PaaS.
The CSP manages physical infrastructure, network infrastructure, virtualization, host OS kernel patching, and database engine maintenance.
PaaS abstracts hardware and OS layers away from the customer so developers can focus on application code and data.
3
Determine the customer organization's remaining security responsibilities.
The customer is always responsible for data classification, application logic security, customer user account authorization, and API client configuration.
Regardless of whether IaaS, PaaS, or SaaS is used, ownership of data classification and access authorization remains strictly with the customer organization.

Key Concept

Cloud Shared Responsibility Model in Platform as a Service (PaaS)
Rate this question

Topics

Cloud Architecture and Deployment Models

More questions from this topic