350-201 Question 42
Select 2A company is migrating its operations to the cloud and is evaluating the security responsibilities for its chosen cloud platform. They have decided to use a mix of Infrastructure as a Service (IaaS) and Platform as a Service (PaaS) offerings. Which of the following are key differences in security operations considerations between IaaS and PaaS?
- A
In IaaS, the customer is responsible for securing the operating system, while in PaaS, the cloud provider manages the operating system security.
- B
IaaS requires the customer to implement application-level security, whereas PaaS provides built-in application security by default.
- C
In IaaS, the customer has control over the underlying hardware, while in PaaS, the hardware is abstracted and fully managed by the provider.
- D
PaaS simplifies patch management for the underlying platform components, while in IaaS, the customer is responsible for patching the operating system.
- E
IaaS provides no logging or monitoring capabilities by default, while PaaS includes comprehensive monitoring tools pre-configured by the provider.
Show answer and explanation
Correct answers: A, D
Explanation
Cloud platforms such as IaaS and PaaS differ significantly in terms of security operations. In IaaS, customers have more control and responsibility over the infrastructure components, including securing and patching the operating system. PaaS, on the other hand, abstracts these tasks, with the cloud provider managing the underlying platform, including operating system security and patch management. Understanding these differences helps organizations assign responsibilities appropriately and secure their environments effectively.
- A. Correct.
Correct. In IaaS, the customer has control over and is responsible for securing the operating system. In PaaS, the cloud provider manages the underlying operating system, reducing the customer’s responsibilities.
- B. Incorrect.
Incorrect. While PaaS does offer some built-in capabilities, application-level security remains a shared responsibility, and customers must secure their applications in both IaaS and PaaS environments.
- C. Incorrect.
Incorrect. In IaaS, the hardware is fully managed by the cloud provider. Customers never directly control the hardware in either IaaS or PaaS, but they do have more control over the virtualized environment in IaaS.
- D. Correct.
Correct. PaaS abstracts much of the platform management, including patching for the underlying platform and operating system, whereas IaaS requires customers to handle the operating system patching themselves.
- E. Incorrect.
Incorrect. Both IaaS and PaaS provide logging and monitoring capabilities, but the extent of pre-configuration and ease of use may vary by provider and specific service.