CCSP Cloud Concepts, Architecture, and Design Practice Question
A company is considering moving its customer relationship management (CRM) system to the cloud. The CRM is accessed through a web browser and the provider handles all maintenance, security, and infrastructure. Which cloud service model is being used?
⚠ Common exam trap
A common mix-up: candidates confuse SaaS with PaaS — candidates see 'web browser access' and 'provider handles maintenance' and pick PaaS, forgetting that PaaS still requires the customer to build and manage the application, whereas SaaS delivers the finished application.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SaaS
SaaS (Software as a Service) is the correct model because the provider delivers a complete, ready-to-use application (the CRM) over the web while managing all underlying infrastructure, platform, security patching, and maintenance. The customer only interacts with the application through a browser and does not manage servers, middleware, or runtime environments. This matches the classic SaaS definition where the consumer uses the provider's application running on cloud infrastructure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IaaS
Why it's wrong here
IaaS delivers virtualised compute, storage and networking that the customer still patches, secures and maintains; here the provider runs everything including the application. It tempts because IaaS underpins many hosted systems, and would be correct if the company managed its own CRM software on provider-supplied virtual machines.
- ✗
FaaS
Why it's wrong here
FaaS runs event-triggered functions with no persistent server or browser-facing application hosting, so it cannot deliver a continuously available CRM interface. It is tempting because it removes all server management, and would be correct for discrete, short-lived tasks such as image resizing or webhook processing.
- ✓
SaaS
Why this is correct
SaaS delivers a complete, provider-managed application over the internet, so the vendor handles infrastructure, patching and security while users simply access the CRM through a browser. This satisfies the stem's constraint that the provider manages all maintenance, security and infrastructure, leaving the company only as a consumer of the finished service.
- ✗
PaaS
Why it's wrong here
PaaS supplies a managed runtime for code the customer deploys; here the provider also owns the application itself, which the browser user consumes directly. PaaS is tempting because it removes OS and middleware management, and would be correct when developers must deploy and manage their own application code.
Go deeper
Related to this question
About these practice questions
One of 934 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.