nerdexam
CompTIA

CAS-003 · Question #354

A managed service provider is designing a log aggregation service for customers who no longer want to manage an internal SIEM infrastructure. The provider expects that customers will send all types…

The correct answer is C. Due to the likelihood of large log volumes, the service provider should use a multi-tenancy model. For large-scale log aggregation services handling sensitive data, a multi-tenancy model with strong isolation controls balances cost efficiency with the scalability needed to handle high log volumes.

Enterprise Security Architecture

Question

A managed service provider is designing a log aggregation service for customers who no longer want to manage an internal SIEM infrastructure. The provider expects that customers will send all types of logs to them, and that log files could contain very sensitive entries. Customers have indicated they want on- premises and cloud-based infrastructure logs to be stored in this new service. An engineer, who is designing the new service, is deciding how to segment customers. Which of the following is the BEST statement for the engineer to take into consideration?

Options

  • ASingle-tenancy is often more expensive and has less efficient resource utilization. Multi-tenancy
  • BThe managed service provider should outsource security of the platform to an existing cloud
  • CDue to the likelihood of large log volumes, the service provider should use a multi-tenancy model
  • DThe most secure design approach would be to give customers on-premises appliances, install

How the community answered

(30 responses)
  • A
    20% (6)
  • B
    3% (1)
  • C
    67% (20)
  • D
    10% (3)

Why each option

For large-scale log aggregation services handling sensitive data, a multi-tenancy model with strong isolation controls balances cost efficiency with the scalability needed to handle high log volumes.

ASingle-tenancy is often more expensive and has less efficient resource utilization. Multi-tenancy

While single-tenancy offers stronger isolation, it is cost-prohibitive at scale and the statement alone does not provide actionable design guidance for the engineer.

BThe managed service provider should outsource security of the platform to an existing cloud

Outsourcing platform security to a third-party cloud provider does not absolve the MSP of its security responsibilities and represents an abdication of design accountability.

CDue to the likelihood of large log volumes, the service provider should use a multi-tenancy modelCorrect

Large log volumes from diverse customers require infrastructure that scales elastically and cost-effectively, which multi-tenancy provides through shared compute and storage resources. The key engineering consideration is implementing robust tenant isolation (separate encryption keys, logical data partitions, strict access controls) so that the efficiency gains of multi-tenancy do not compromise the confidentiality of sensitive log entries across customer boundaries.

DThe most secure design approach would be to give customers on-premises appliances, install

Providing on-premises appliances defeats the purpose of a managed cloud log aggregation service and creates an unmanageable support and consistency burden.

Concept tested: Multi-tenancy architecture for managed SIEM log aggregation

Source: https://csrc.nist.gov/publications/detail/sp/800-145/final

Topics

#multi-tenancy#SIEM#log management#cloud security architecture

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-003 Practice