CCSP Cloud Concepts, Architecture, and Design Practice Question
A cloud security manager is evaluating the security responsibilities of the cloud provider and the cloud consumer under the shared responsibility model for a PaaS deployment. Which TWO of the following are typically the responsibility of the cloud consumer? (Choose two.)
⚠ Common exam trap
The trap here is assuming that because the provider manages the platform, the consumer has no security responsibilities, or confusing infrastructure-level responsibilities with application-level ones.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Managing user identities and access within the application
In a PaaS model, the cloud provider manages the underlying infrastructure, including servers, operating systems, and runtime environments, while the consumer is responsible for the security of their applications and data. This includes configuring application-level security controls and managing user identities and access within the application. These two areas fall under the consumer's control and are critical for protecting the application from threats.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Managing the physical security of data centers
Why it's wrong here
Physical security of data centers is always the responsibility of the cloud provider, regardless of the service model. The consumer does not have access to the physical facilities and cannot implement controls such as biometric access or surveillance. Therefore, this is not a consumer responsibility in PaaS.
- ✗
Securing the hypervisor and virtualization layer
Why it's wrong here
The hypervisor and virtualization layer are part of the provider's infrastructure and are managed by the cloud provider. The consumer has no visibility or control over these components. Thus, securing them is not a consumer responsibility in any cloud service model.
- ✗
Patching the underlying operating system and runtime
Why it's wrong here
In PaaS, the cloud provider manages the operating system, runtime, and middleware patching. The consumer does not have access to the underlying OS and cannot apply patches. Therefore, this is a provider responsibility, not a consumer one.
- ✓
Managing user identities and access within the application
Why this is correct
The consumer is responsible for managing user identities and access within their application, including creating user accounts, assigning roles, and enforcing least privilege. While the provider may offer identity services, the consumer must configure and manage them for their specific application. This is a key consumer responsibility in PaaS.
- ✓
Configuring application-level security controls
Why this is correct
In PaaS, the consumer is responsible for securing the applications they deploy on the platform. This includes configuring authentication, authorization, input validation, and other application-level controls. The provider secures the platform itself, but the consumer must ensure their application code and configurations are secure.
Go deeper
Related to this question
About these practice questions
One of 934 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.