A biomedical research organization is implementing an event-driven serverless (Function-as-a-Service) workflow to process sensitive genomic datasets. The solution operates within a community cloud model shared among research partners and integrates with an on-premises data repository via a secure hybrid connection. The security architecture team must define strict operational responsibilities in accordance with the cloud shared responsibility model. Which of the following security management tasks remain the direct responsibility of the biomedical research organization? (Select TWO.)
- Configuring function-level identity authorization policies and managing data classification rules for the genomic datasetsCevap
- Managing customer-managed encryption keys (CMEK) and defining API gateway access token validation logicCevap
- CApplying security patches and kernel updates to the underlying serverless execution environment and host OS
- DEnforcing hypervisor isolation controls and physical hardware separation between research partner tenants
Cevap
The research organization is directly responsible for configuring function-level authorization policies with data classification rules, as well as managing customer-managed encryption keys (CMEK) alongside API gateway access token validation logic.
In serverless architecture (FaaS), the Cloud Service Provider manages the underlying hardware, hypervisors, server OS, and runtime infrastructure. However, the customer retains sole responsibility for data governance (classification and encryption key management) and identity control (API access token rules and function authorization policies).
Adım Adım Çözüm
Anahtar Kavram
Cloud Shared Responsibility Model in FaaS / Serverless Deployments