ECSA v10: EC-Council Certified Security Analyst v10

By ECCouncil · Question Mode

QuestionQ12

VerifiedCloud Penetration Testing Methodology

SecGlobal Corporation hired Michael as a penetration tester. Management requested that Michael conduct cloud penetration testing on the company’s cloud infrastructure.

As part of this assignment, he reviewed all agreements with the cloud service provider and concluded that, because of the division of responsibilities between the company and the Cloud Service Provider (CSP), penetration testing cannot be performed on the cloud services used by the organization.

Identify the type of cloud service deployed by the organization?

Explanation

Software as a Service (SaaS) delivers a ready-made application while the provider manages the underlying infrastructure, platform services, and network controls. Because the customer has the least control over the service stack in SaaS, testing of provider-managed components is generally outside the customer’s responsibility and subject to the provider’s authorization and rules. Microsoft Learn: Shared responsibility in the cloud

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!