An infrastructure as a Service cloud provider provides both single tenant and multi-tenant virtual machine based
cloud offerings using the Xen hypervisor. A zero-day vulnerability is found with Xen and is being reported and
managed by the closed community established by Xen for managing these types of situations. The cloud
provider is a member of this closed community. What is the communication flow between cloud provider and
customer throughout the management and resolution of this issue?

A.
Closed community to customer – notification that there is a vulnerability and that customer must notify cloud
provider to schedule updates/remediation.

B.
Customer to cloud provider – notification that there is a vulnerability and scheduling of vulnerability patch
deployment to avoid impact on customer’s production workload.

C.
Cloud provider to customer – notification that there is a vulnerability and that cloud provider is taking steps
to address.

D.
None – the cloud provider may not communicate anything to the customer until the communication of the
vulnerability (embargo) is allowed by the closed community.

Explanation:
https://en.wikipedia.org/wiki/Closed_community