SSCP Systems and Application Security Practice Question
According to the shared responsibility model in cloud computing, which security responsibility belongs to the customer in a SaaS deployment?
⚠ Common exam trap
The trap is that candidates assume SaaS means 'the provider secures everything' and pick an option like application code or OS management, forgetting that data and access control always stay with the customer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data classification and access controls
In the shared responsibility model, the cloud provider always owns security *of* the cloud (physical facilities, hypervisor, host OS, and for SaaS the application itself), while the customer always owns security *in* the cloud — their data, identities, and access decisions. Data classification and access controls are therefore unambiguously customer responsibilities in every cloud service model, including SaaS. This is the one responsibility that never transfers to the provider.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Physical security of data centers
Why it's wrong here
Physical security of data centres sits with the cloud provider in every deployment model, including SaaS, since the customer never touches the hardware. It becomes a customer responsibility only for on-premises or colocation hosting, where the organisation owns the facility and its controls.
- ✗
Securing the application code
Why it's wrong here
In SaaS, the provider owns the application, runtime, and data infrastructure, so customers cannot secure application code they do not control. It is tempting because code security is a customer duty in IaaS and PaaS, but SaaS customers are responsible only for their data, identities, and access configuration.
- ✓
Data classification and access controls
Why this is correct
In SaaS, the provider secures the application, runtime and underlying infrastructure, while the customer retains ownership of its data. Classifying that data and controlling who may access it therefore remain customer responsibilities, since only the customer understands its sensitivity and business access requirements.
- ✗
Managing the underlying operating system
Why it's wrong here
In SaaS the provider runs the operating system, patching and hardening it beneath the application layer; the customer only manages data, access and configuration. Managing the OS is the customer's duty in IaaS, where they control the full stack from the OS upward, which is why this option tempts.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.