A library consortium prefers managed BAS-in-cloud over self-hosted attack VMs because staffing is thin. What tradeoff are they weighing?
Select an answer to reveal the explanation.
Short Explanation
Thin staff means you may rent the cloud BAS gym instead of building your own attack-VM weight room. Managed platforms trade some control for less babysitting. You're not weighing cloud emulation against a honeypot mesh — that's decoys for luring attackers, not attack VMs you're too thin-staffed to babysit.
Full Explanation
Weighing tradeoffs between managed cloud emulation platforms and self-hosted civic ranges when staffing is limited is the decision a thin-staffed library consortium is actually making. Managed BAS-in-cloud reduces patching, hypervisor babysitting, and custom attack-VM lifecycle work, which matters when library IT cannot sustain a full offensive lab. The tradeoff is real: managed platforms buy operational capacity and faster scenario updates at the cost of some customization and vendor dependency, while still requiring civic oversight of scope and data handling. Tradeoffs between managed cloud emulation platforms and self-hosted SIEM collectors when staffing is limited misstates the self-hosted side; the consortium is choosing between managed cloud and self-hosted attack VMs and civic ranges, not defensive SIEM collectors for log ingestion, so collector upkeep misses the offensive-lab staffing decision at the heart of the stem. Tradeoffs between managed cloud detection platforms and self-hosted civic ranges when staffing is limited confuses detection with emulation; BAS-in-cloud is offensive emulation to validate controls, not managed detection and response, so it misses the staffing-limited emulation-hosting decision the consortium faces. Tradeoffs between managed cloud emulation platforms and self-hosted honeypot meshes when staffing is limited changes the comparator; honeypot meshes are defensive decoys to attract attackers, not self-hosted attack-VM ranges for generating emulated attacks, so it is not the choice between managed cloud and self-hosted ranges when staffing is thin. Exam caveat: "managed" does not mean "set and forget"; contract terms, data residency, and who can start production-touching scenarios must still be defined. Operational check: compare staff hours required to keep a self-hosted range patched versus the managed platform's update cadence, then verify the library retains kill-switch, logging export, and written approval gates regardless of hosting model.
Prefer to study offline? Printable PDF study book + test engine ($7.50, unofficial). These questions stay free here.