SY0-701 Security Architecture Practice Question
A development team wants to deploy a new internal application without managing operating system patching, runtime updates, or automatic scaling. The security team still wants the company to control the application code and its data access settings. Which cloud service model best fits this need?
⚠ Common exam trap
Many exam-takers confuse PaaS with IaaS, assuming 'no patching' means IaaS, but IaaS still requires the customer to patch the guest OS and runtime, whereas PaaS fully offloads that responsibility.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Platform as a Service, because the provider manages the platform and the company manages the application and data.
Platform as a Service (PaaS) is the correct choice because the provider manages the underlying platform—including OS patching, runtime updates, and automatic scaling—while the company retains control over the application code and data access settings. This aligns with the shared responsibility model where the customer is responsible for the application and data, not the infrastructure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Infrastructure as a Service, because the company can ignore guest OS patching entirely.
Why it's wrong here
Infrastructure as a Service (IaaS) delivers virtual machines and raw compute, but the corporate customer retains full responsibility for the guest operating system, including security patching, runtime management, and often the middleware stack. Because the cloud provider only patches the underlying hypervisor and physical hosts, the development team would still perform the same platform maintenance duties, so this model does not reduce operational overhead for the new internal application.
- ✓
Platform as a Service, because the provider manages the platform and the company manages the application and data.
Why this is correct
Platform as a Service (PaaS) provides a managed runtime environment where the provider automatically handles the underlying servers, operating system, runtime engine, and often scaling and patching, while the company retains control over the application source code, its configuration, and the data stored by the application. This division of responsibility lets the development team focus on building the internal app and stops them from manually maintaining the platform, making it the correct choice for the stated deployment goal.
- ✗
Software as a Service, because the team can deploy custom application code inside the vendor portal.
Why it's wrong here
Software as a Service (SaaS) is a fully functional, ready-to-use product such as a CRM or email system, where the vendor owns the entire application stack and merely grants tenants configuration options, APIs, and user interfaces. The team cannot upload arbitrary server-side application code into the vendor's portal, so this model is incompatible with deploying a new custom internal application and would actually force the team to forfeit control over its functionality.
- ✗
On-premises hosting, because the company can still use the provider's patching tools.
Why it's wrong here
On-premises hosting means the development team deploys the application on hardware located within the company's own data centers, so there is no cloud provider involved and no provider patching tools available. The team remains responsible for every layer: physical hardware, boot firmware, operating system, platform services, and application, meaning any promise of reducing platform maintenance through provider patching is incorrect.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.