ISC2 CISSP Practice Question

Platform as a Service (PaaS) is the most appropriate choice for this scenario because it provides a middle ground between IaaS and SaaS. With PaaS, the organization retains control over the application code, configuration, and security settings, which is critical for a financial application handling sensitive data. The cloud provider manages the underlying infrastructure (servers, networks, storage) and the platform components (operating systems, middleware, runtime). This allows the financial services company to focus on their application security while reducing infrastructure management responsibilities.

Infrastructure as a Service (IaaS) would require the company to manage too many components including operating systems, middleware, and runtime environments, which contradicts their desire to reduce infrastructure management. Software as a Service (SaaS) would not provide enough control over the application code and configuration as the entire application would be managed by the provider. Function as a Service (FaaS) is too granular for a complete web application migration and typically supports specific event-driven functionality rather than complete applications.