ISC2 Certified in Cybersecurity (CC) Practice Question

In the SaaS model the provider operates and maintains the entire stack that supports the application-including physical hardware, virtualization, network, operating system, middleware, and the application itself. The customer therefore is not required to patch servers or manage infrastructure. What the customer must still govern is how its own users access the service and the data they store or process within it. Physical hardware, operating-system updates, and runtime environments are all handled by the SaaS provider, leaving user accounts and data as the main areas of customer responsibility.