Examkin

Soru

Zorluk: ZorCloud Architecture and Deployment Models

A software company hosts a critical customer service portal on a Managed Kubernetes platform (PaaS). The cloud service provider (CSP) maintains the master control plane, hypervisor infrastructure, and worker node operating system updates. During a recent vulnerability scan, security auditors identified critical security flaws in the application runtime dependencies packaged inside the deployment container images. Which of the following actions represents the customer's responsibility under the cloud shared responsibility model to remediate these vulnerabilities?

  1. Implement container image scanning in the CI/CD pipeline to detect and patch vulnerable application dependencies prior to deployment.Cevap
  2. B
    Submit an urgent support request requiring the cloud provider to patch the vulnerable application runtime libraries on the running containers.
  3. C
    Configure an edge perimeter firewall rule to trust all internal container worker node traffic automatically without further inspection.
  4. D
    Reclassify the application container libraries as physical infrastructure controls covered under the provider's compliance attestation.

Cevap

Implement container image scanning in the CI/CD pipeline to detect and patch vulnerable application dependencies prior to deployment.
Under the cloud shared responsibility model for Platform as a Service (PaaS) and managed container environments, the cloud service provider manages physical infrastructure, hypervisors, and the container engine/node operating system. However, the customer is strictly responsible for securing everything inside their container images, including custom application code, third-party libraries, and dependencies. Scanning container images within the CI/CD pipeline ensures vulnerable dependencies are identified and updated by the customer before deployment.

Adım Adım Çözüm

1
Analyze the cloud service model and operational context.
The scenario describes a Managed Kubernetes platform operating under Platform as a Service (PaaS).
Identifying the service model establishes the boundaries between customer and CSP responsibilities.
2
Delineate responsibilities between the CSP and the customer.
The CSP manages physical hardware, hypervisors, control plane components, and worker node OS patching. The customer retains ownership of application code, container images, data, and application runtime dependencies.
Under the shared responsibility model, application code and custom container layers are exclusively managed by the tenant.
3
Evaluate remediation options based on customer ownership.
Incorporating dependency scanning and base image updating within the customer's CI/CD pipeline directly resolves the vulnerability at the customer-managed application layer.
Proactive image analysis prevents vulnerable software components from reaching production environments.

Anahtar Kavram

Cloud Shared Responsibility Model in Managed Platform Services
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Cloud Architecture and Deployment Models

Bu konudan daha fazla soru