Question

Difficulty: EasySoftware as a Service (SaaS)

A business transitions its legacy human resources (HR) portal to a cloud-based Software as a Service (SaaS) solution. Under the shared responsibility model, the cloud provider manages the physical infrastructure, virtualization, operating systems, and the application software. Which of the following responsibilities remains with the customer?

  1. Configuring user access permissions and managing identity dataAnswer
  2. B
    Applying software updates and security patches to the application code
  3. C
    Maintaining the underlying virtual machines and server operating systems
  4. D
    Paying upfront capital expenditures for the physical server hardware

Answer

Configuring user access permissions and managing identity data
Under the Software as a Service (SaaS) model, the cloud provider manages the entire application, middleware, operating systems, and physical infrastructure. However, the customer always retains responsibility for managing their own data, user accounts, identities, and access configurations. Therefore, configuring user access permissions and managing identity data remains the customer's responsibility.

Step-by-Step Solution

1
Analyze the cloud service model referenced in the scenario.
The scenario describes Software as a Service (SaaS), where the cloud provider manages almost the entire stack including hardware, operating systems, database management systems, and application software.
Identifying the service model determines the division of responsibility between the customer and the cloud provider.
2
Apply the shared responsibility model rules for SaaS to identify the customer's duties.
Under SaaS, the customer's responsibilities are limited to information and data, devices (mobile and PCs), and accounts and identities.
This determines which of the provided choices represents a task still owned by the customer.

Key Concept

Under the SaaS shared responsibility model, the customer retains responsibility for managing their own data, devices, and user accounts/identities, while the provider manages everything else.
Rate this question