SY0-701 Security Architecture Practice Question
A company uses a SaaS file-sharing platform for employee documents. Which action is the company's responsibility, not the provider's?
⚠ Common exam trap
Test-takers frequently confuse the SaaS model with IaaS or PaaS, incorrectly assuming the customer is responsible for patching or hardware maintenance, when in fact the provider handles all infrastructure layers in SaaS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Setting user sharing permissions and access controls for company data.
In a SaaS model, the provider manages the underlying infrastructure, including application servers, storage, and hypervisors. The customer is responsible for configuring access controls and permissions for their own data within the application. Option B correctly identifies this shared responsibility boundary.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Patching the vendor's application servers.
Why it's wrong here
Patching the vendor's application servers is the SaaS provider's responsibility, not the customer's. In a software-as-a-service model, the vendor manages the full application stack, including operating systems, runtime, and application code, and applies all security patches and updates. The customer organization has no administrative access to these underlying servers and cannot alter them; its duty is limited to configuring the application's features and managing user access.
- ✓
Setting user sharing permissions and access controls for company data.
Why this is correct
In a SaaS model, the provider manages the application and underlying infrastructure, but the customer remains responsible for how the service is used. That includes user provisioning, access permissions, sharing settings, and data handling decisions. Configuring who can see or edit documents is a customer duty because it directly affects the organization's confidentiality and compliance obligations.
- ✗
Replacing failed disks in the provider's storage cluster.
Why it's wrong here
Replacing failed disks in the provider's storage cluster falls under the cloud provider's operational and hardware maintenance duties, not the customer's. In SaaS, the customer leases storage as part of the service, and the provider is responsible for maintaining the physical and virtual infrastructure that supports it. The customer's responsibility centers on how data is classified, shared, and protected, not on hardware lifecycle actions like disk replacement.
- ✗
Maintaining the cloud provider's identity center and hypervisor.
Why it's wrong here
Maintaining the cloud provider's identity center and hypervisor is inherently the provider's role because these are core components of the SaaS platform's underlying architecture. The customer may integrate with the provider's identity center via federation (e.g., SAML or OIDC), but it does not operate or maintain the provider's authentication backend or virtualization layer. Even if the customer manages SSO settings, the provider remains responsible for the availability and security of the hypervisor and the identity infrastructure that the service runs on.
Go deeper
Related to this question
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses a SaaS email platform. The provider manages the servers and application code. Which two tasks remain the company's responsibility? Select two.
easy- ✓ A.Configuring who can access company mailboxes and administrative roles.
- B.Applying security patches to the provider's mail servers.
- ✓ C.Deciding what data may be stored in the service and how it is classified.
- D.Replacing failed provider storage disks.
- E.Hardening the provider's hypervisor.
Why A: In a SaaS model, the customer retains administrative control over user access and role-based permissions. This includes configuring mailbox permissions, setting up multi-factor authentication, and managing administrative roles within the provider's interface. The provider handles the underlying infrastructure, but identity and access management (IAM) remains the customer's responsibility.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.