CCSP Cloud Concepts, Architecture, and Design Practice Question
Which NIST SP 800-145 cloud service model provides the consumer with the ability to deploy applications onto a cloud infrastructure where the consumer does not manage the underlying cloud infrastructure, including network, servers, operating systems, or storage, but has control over the deployed applications and possibly configuration settings for the application-hosting environment?
⚠ Common exam trap
CCSP often tests the precise NIST 800-145 wording — candidates confuse PaaS with IaaS because both allow application deployment, but IaaS requires the consumer to manage the OS and storage, which the question explicitly excludes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Platform as a Service (PaaS)
NIST SP 800-145 defines PaaS as the model where the consumer deploys applications onto cloud infrastructure but does not manage the underlying network, servers, operating systems, or storage. The consumer controls the deployed applications and possibly application-hosting environment configurations — exactly matching the question's description. This is the canonical PaaS definition.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Platform as a Service (PaaS)
Why this is correct
Platform as a Service (PaaS) satisfies the stem's constraint: the consumer deploys applications onto provider-managed infrastructure without controlling network, servers, operating systems or storage, yet retains control over deployed applications and possibly application-hosting environment configuration. This matches NIST SP 800-145's PaaS definition precisely, distinguishing it from IaaS, where the consumer manages the operating system.
- ✗
Function as a Service (FaaS)
Why it's wrong here
FaaS executes event-driven code snippets without exposing any application-hosting environment for consumer configuration, so it cannot satisfy the stem's requirement for control over deployed applications and hosting settings. It is tempting because FaaS also leaves network, servers, operating systems and storage entirely provider-managed, but that model suits discrete functions, not deploying complete applications.
- ✗
Software as a Service (SaaS)
Why it's wrong here
SaaS delivers a complete, provider-managed application, so the consumer controls only user-specific configuration data — not deployed applications or hosting settings. It is tempting because SaaS also hides all underlying infrastructure, matching the stem's management exclusions. SaaS would be correct if the question asked which model offers a finished application rather than a deployment platform.
- ✗
Infrastructure as a Service (IaaS)
Why it's wrong here
IaaS leaves the consumer managing operating systems, storage and networking; the stem describes control limited to deployed applications, which is PaaS. It is tempting because IaaS does let consumers deploy applications onto cloud infrastructure, and would be correct if they also managed the underlying virtual machines and operating systems.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.