CV0-004 Cloud Architecture and Design Practice Question
A company is using a PaaS offering to host a web application. Which THREE management responsibilities are retained by the customer? (Select THREE.)
⚠ Common exam trap
CV0-004 often tests the shared responsibility model, and candidates frequently confuse provider-managed components (like runtime and OS) with customer-managed ones, leading them to incorrectly select options that are actually the provider's responsibility.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Application code
In a PaaS model, the provider manages the platform stack (runtime, middleware, OS, virtualization), while the customer retains responsibility for what they deploy and control on top of it. Option B (Application code) is correct because the customer writes, deploys, and maintains the application itself, including its logic, dependencies, and updates. Option D (Data and its security) is correct because the customer owns the data, controls classification, encryption, backup, and access policies, even though the provider secures the underlying storage infrastructure. Option E (Access and identity management) is correct because the customer manages user accounts, roles, authentication, and authorization for their application and data, typically via the provider's IAM tooling or federation. Option A (Runtime environment) is not retained by the customer, as the PaaS provider manages the language runtime, libraries, and execution environment. Option C (Operating system patches) is not retained by the customer, since the provider handles OS-level patching and maintenance in a PaaS offering.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Runtime environment
Why it's wrong here
The provider manages the runtime environment in PaaS, including language runtimes and middleware, so the customer does not retain it. It is tempting because runtime management belongs to the customer in IaaS virtual machines, but PaaS abstracts that layer, leaving the customer responsible only for applications and data.
- ✓
Application code
Why this is correct
In PaaS, the provider manages the runtime, middleware, and operating system, but the customer still writes, deploys, and patches the application code itself. This retained responsibility satisfies the scenario's requirement to identify what the customer still manages.
- ✗
Operating system patches
Why it's wrong here
In PaaS the provider patches and maintains the underlying operating system, so the customer does not retain this responsibility. It is tempting because OS patching is a customer task in IaaS, where the customer manages everything from the OS upward, but PaaS shifts that layer to the provider.
- ✓
Data and its security
Why this is correct
PaaS shifts infrastructure management to the provider, yet the customer remains accountable for the data stored and processed, including classification, encryption, and access controls protecting it. This retained responsibility satisfies the scenario's requirement to identify customer-managed elements.
- ✓
Access and identity management
Why this is correct
Identity and access management stays with the customer under PaaS: they define users, roles, and permissions governing who reaches the application and its data. The provider secures the platform, not tenant identities, satisfying the scenario's retained-responsibility requirement.
Go deeper
Related to this question
About these practice questions
One of 834 original CV0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.