CompTIA Cloud Essentials+ (CLO-002)Cloud ConceptsMedium
A company operating in a highly regulated industry is evaluating a public cloud provider for its new application. The application will process sensitive customer data. Under the shared responsibility model, which of the following is primarily the cloud provider's responsibility for a PaaS offering?
- AOperating system patching and virtualization layer security
- BApplication code security and vulnerability management
- CNetwork controls and firewall configuration for the application
- DData encryption at rest and in transit for customer data
Show answer & explanationAnswer & explanation
Correct answer: A. Operating system patching and virtualization layer security
In a PaaS model, the cloud provider is responsible for managing and securing the underlying infrastructure, including the operating system, middleware, and virtualization layer. The customer is responsible for their application code, data, and configuration of platform-level security features.
Why the other options are wrong
- B. Application code security is always the customer's responsibility, regardless of the service model.
- C. While the provider manages the underlying network, the customer is typically responsible for configuring network controls specific to their application within the PaaS environment.
- D. Though the provider offers encryption services, the customer is responsible for implementing and managing encryption for their specific data.
Shared Responsibility Model (PaaS)
A framework outlining the security responsibilities between a cloud provider and a customer, where the provider handles the platform and infrastructure, and the customer handles their applications and data.
- Provider: OS, middleware, runtime, network, storage, physical security.
- Customer: Applications, data, configuration, access management.
- Responsibilities shift based on service model (IaaS, PaaS, SaaS).
Memory trick: PaaS: Provider 'P'atches and 'P'latform, Customer 'C'odes and 'C'onfigures.