Drag a concept onto its matching description — or click a concept then click the description.
Concepts
Matches
Application security
Platform security
Infrastructure security
Full stack security
CCSP Cloud Application Security Practice Question
Match each cloud service model to its primary responsibility area according to the shared responsibility model.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SaaS: Provider manages all infrastructure, platform, and application software; customer manages data and access control.
The shared responsibility model delineates security obligations; SaaS offloads most to provider, on-premises retains all.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SaaS: Provider manages all infrastructure, platform, and application software; customer manages data and access control.
Why this is correct
In SaaS, the provider is responsible for the entire stack except customer data and identity management.
- ✓
PaaS: Provider manages runtime, middleware, and operating system; customer manages applications and data.
Why this is correct
PaaS abstracts the underlying infrastructure, leaving the customer to manage only their applications and data.
- ✓
IaaS: Provider manages physical hardware, virtualization, and networking; customer manages OS, applications, and data.
Why this is correct
IaaS provides compute, storage, and networking resources; the customer configures and secures the OS and applications.
- ✓
On-premises: Customer manages all components from physical infrastructure to data and applications.
Why this is correct
On-premises deployments place full responsibility on the customer.
- ✗
SaaS: Provider manages only physical security; customer manages all other aspects including applications and data.
Why it's wrong here
Incorrect — SaaS providers manage most of the stack; customers are not responsible for applications or infrastructure.
- ✗
IaaS: Provider manages operating system, applications, and data; customer manages physical servers.
Why it's wrong here
Incorrect — IaaS providers manage physical hardware, not the OS or applications; that is the customer's responsibility.
Go deeper
Related to this question
About these practice questions
One of 964 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.