How can web security as a service be deployed for a cloud consumer?

The Software Defined Perimeter (SDP) includes which components?

Which of the following is not an abuse or misuse of cloud services?

Sara has a very old application running in her infrastructure. It is difficult to migrate to the cloud.
Instead, she opted to get a new custom application built in the cloud. What service model she should for, if the application is going to use a combination of various languages and databases?

Which of the below hypervisors are 0S based and are more attractive to attackers?