[Security Architecture] Which of the following are risks associated with vendor lock-in? (Select two).

Vendor lock-in describes a situation where a client is dependent on a single vendor for products or services and cannot easily switch to another vendor without substantial costs or operational disruption. This dependency creates several risks. A primary risk is that the vendor, facing little competition for the client's business, can unilaterally change product offerings, pricing, or terms, leaving the client with no viable alternative. Another significant risk is a decreased quality of service, as the vendor may have less incentive to maintain high standards when the client is effectively "trapped."

A. The client can seamlessly move data.

This is the opposite of vendor lock-in; a lack of data portability is a key cause of lock-in.

C. The client receives a sufficient level of service.

This is a positive outcome, not a risk. The risk is that the service level will become insufficient.

E. The client can leverage a multicloud approach.

A multicloud strategy is a common technique used to mitigate or avoid vendor lock-in, not a risk associated with it.

F. The client experiences increased interoperability.

Increased interoperability reduces the barriers to switching vendors, thereby counteracting vendor lock-in.

---

1. Armbrust

M.

Fox

A.

Griffith

R.

Joseph

A. D.

Katz

R.

Konwinski

A.

Lee

G.

Patterson

D.

Rabkin

A.

Stoica

I.

& Zaharia

M. (2009). Above the Clouds: A Berkeley View of Cloud Computing (Technical Report No. UCB/EECS-2009-28). EECS Department

University of California

Berkeley. In Section 4

"Top 10 Obstacles and Opportunities for Cloud Computing

" Obstacle #2

"Vendor Lock-In

" discusses how proprietary APIs and data formats make it hard to switch providers

exposing clients to risks like price hikes or the provider ceasing operations

which directly relates to the vendor changing its offerings.

2. National Institute of Standards and Technology (NIST). (2011). NIST Cloud Computing Reference Architecture (NIST Special Publication 500-292). In Section 5.3.3

"Portability and Interoperability

" the document explains that a lack of portability leads to "a high degree of dependency on a particular cloud provider." This dependency underpins the risks of degraded service and unfavorable changes to offerings.

3. Lebeck

K.

et al. (2017). Cloud-agnostic object storage. Duke University Department of Computer Science. This paper discusses vendor lock-in as a major concern

stating

"customers fear that providers will exploit this lock-in by raising prices or letting service quality degrade" (Section 1

Paragraph 2). This directly supports that decreased service quality is a primary risk.

4. Ardagna

D.

et al. (2014). MODA-Clouds: A Model-Driven Approach for the Design and Runtime Management of Multi-Cloud Applications. In Cloud Computing and Services Science. Communications in Computer and Information Science

vol 453. Springer. The authors state

"Vendor lock-in is one of the main obstacles to the adoption of cloud computing

as it may expose customers to risks such as unexpected price increases

decrease in the quality of service

or even service termination" (Chapter Introduction

Paragraph 2).