SSCP Systems and Application Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Data classification and user access management

  Why this is correct

  In SaaS, the provider secures the application, runtime and infrastructure, while the customer retains responsibility for its own data classification and managing which users may access that data. These controls sit above the provider's boundary, satisfying the stem's shared responsibility constraint.

• ✗

  Network infrastructure security

  Why it's wrong here

  The SaaS provider owns the network infrastructure delivering the service, so its security is not primarily the customer's responsibility. It is tempting because network controls are customer-managed in IaaS and PaaS, where the customer configures virtual networks and firewalls, but SaaS removes that layer from customer scope.

• ✗

  Physical security of data centers

  Why it's wrong here

  Physical security of data centres sits with the cloud provider under the shared responsibility model, so the customer never owns it in SaaS. It tempts because customers do secure their own on-premises server rooms, making the control feel familiar, but that scenario is IaaS or on-premises hosting, not SaaS.

• ✗

  Operating system patching

  Why it's wrong here

  In SaaS the provider manages the underlying operating system, so patching it is not the customer's duty; the customer patches only its own endpoints and clients. It is tempting because OS patching is a classic customer task in IaaS, where the customer controls the guest OS, but SaaS abstracts that layer away.

Go deeper

Related to this question