SSCP Systems and Application Security Practice Question
An organization using PaaS (Platform as a Service) for application hosting wants to ensure the application code is secure. Which of the following is the customer's responsibility under the shared responsibility model?
⚠ Common exam trap
SSCP often tests the shared responsibility model by presenting platform-layer tasks (OS patching, runtime patching) as if they were customer duties; the trap is forgetting that in PaaS the provider owns everything below the application, so only application code and data remain with the customer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Securing the application code from SQL injection
Under the shared responsibility model for PaaS, the cloud provider manages the physical infrastructure, the operating system, and the runtime environment, while the customer is responsible for the security of the application code and data they deploy. Securing application code against SQL injection is therefore the customer's responsibility because it involves how the application is written and how it handles input.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Physical security of the data center
Why it's wrong here
Physical security of the data centre always belongs to the cloud provider, regardless of service model. It is tempting because physical controls are a genuine customer concern in on-premises hosting, where the organisation owns the building and its access controls. PaaS removes that layer entirely from tenant scope.
- ✗
Patching the web server runtime
Why it's wrong here
Patching the web server runtime sits with the provider under PaaS, since the platform layer is managed for the customer. It is tempting because runtime patching is a genuine customer duty in IaaS, where the guest OS and its middleware remain under tenant control. Here the provider owns it.
- ✗
Patching the underlying operating system
Why it's wrong here
Under PaaS the provider patches the underlying operating system, so this is not the customer's task. It is tempting because OS patching is a real customer responsibility in IaaS, where the tenant manages the guest OS. PaaS abstracts that layer away, leaving only application code and data to the customer.
- ✓
Securing the application code from SQL injection
Why this is correct
In PaaS, the provider secures the runtime, OS and infrastructure, but the customer retains ownership of the deployed application. Input validation and parameterised queries to prevent SQL injection sit squarely with the customer, satisfying the stem's requirement to secure application code.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.