Certified Cloud Security Professional (CCSP)Cloud Security OperationsHard
An organization is migrating its on-premises Security Operations Center (SOC) to a cloud-native model. The team wants to leverage cloud capabilities to enhance incident response speed and efficiency. Which cloud operational model offers the greatest potential for automated and rapid scaling of incident response tools and data processing during a major security incident?
- AServerless Computing (FaaS)
- BPlatform as a Service (PaaS)
- CInfrastructure as a Service (IaaS)
- DSoftware as a Service (SaaS)
Show answer & explanationAnswer & explanation
Correct answer: A. Serverless Computing (FaaS)
Serverless computing (Functions as a Service, FaaS) provides automatic scaling and ephemeral execution, perfectly suited for bursty incident response workloads without manual provisioning or management overhead, leading to rapid and efficient scaling.
Why the other options are wrong
- B. PaaS offers a managed platform, reducing some operational overhead, but serverless provides even finer-grained, event-driven scaling for specific functions.
- C. IaaS provides raw compute resources, but scaling and management of incident response tools still require significant manual effort or extensive automation setup.
- D. SaaS solutions are pre-built applications where the provider manages everything, offering less flexibility for custom incident response tool integration and scaling strategies.
Serverless Computing (FaaS) for IR
Leveraging Function as a Service (FaaS) platforms in the cloud to execute incident response tasks, offering automatic scaling, pay-per-execution, and reduced operational overhead.
- Ideal for bursty, event-driven workloads (e.g., log processing, alert enrichment).
- Automatically scales up and down based on demand.
- Reduces infrastructure management overhead.
Memory trick: Serverless is like a 'fire and forget' missile for scaling.