350-201 Question 44
Select 3A cybersecurity team is tasked with ensuring proper security controls for their organization's applications hosted on both Infrastructure as a Service (IaaS) and Platform as a Service (PaaS) cloud platforms. Which of the following considerations are specific to IaaS compared to PaaS?
- A
Responsibility for operating system patching and updates
- B
Securing application code and middleware configurations
- C
Managing firewall rules and network segmentation
- D
Ensuring proper API security for third-party integrations
- E
Provisioning virtual machines and storage resources
Show answer and explanation
Correct answers: A, C, E
Explanation
IaaS provides organizations with control over the underlying infrastructure, requiring them to manage tasks like operating system updates, network configurations, and resource provisioning. In contrast, PaaS abstracts much of this responsibility, focusing more on application and middleware management. This makes certain security considerations, such as firewall management and VM provisioning, unique to IaaS environments.
- A. Correct.
In IaaS, the organization is responsible for managing the operating system, including patching and updates, as the cloud provider only manages the underlying infrastructure.
- B. Incorrect.
Securing application code and middleware configurations is a shared responsibility in PaaS and IaaS, making it applicable to both models rather than being specific to IaaS.
- C. Correct.
IaaS requires the user to manage network configurations, including firewall rules and segmentation, as they have control over the virtualized infrastructure.
- D. Incorrect.
API security is relevant in both IaaS and PaaS models, and the responsibility depends on the specific deployment. It is not a consideration unique to IaaS.
- E. Correct.
In IaaS, the organization is responsible for provisioning and managing virtual machines and storage, as this is part of the infrastructure-level control provided by the cloud provider.