CompTIA Cloud+ (CV0-004)Cloud ArchitectureMedium
A company is implementing a shared responsibility model for its cloud services. They are using a Platform as a Service (PaaS) offering for their application development. According to the shared responsibility model, which of the following is primarily the cloud provider's responsibility in this scenario?
- AData encryption at rest for application data
- BApplication code development and deployment
- COperating system patching and management
- DNetwork configuration within the application
Show answer & explanationAnswer & explanation
Correct answer: C. Operating system patching and management
In a PaaS model, the cloud provider is responsible for managing the underlying infrastructure, including the operating system, its patching, and the runtime environment. The customer focuses on their application code and data.
Why the other options are wrong
- A. Customers are generally responsible for the security of their data, including encryption at rest, even though the provider may offer tools to facilitate it.
- B. Application code development and deployment is always the customer's responsibility in PaaS.
- D. While the provider manages the network infrastructure, the customer is typically responsible for application-level network configurations within their deployed application.
Shared Responsibility Model (PaaS)
A framework outlining the security responsibilities between a cloud provider and its customer. In PaaS, the provider manages the underlying infrastructure and platform, while the customer is responsible for applications, data, and access controls.
- Provider: physical security, infrastructure, OS, network controls
- Customer: application, data, identity & access management, network configuration within app
- Context-dependent on service model (IaaS, PaaS, SaaS)
Memory trick: PaaS: provider's platform, your apps.