ISC2 Certified Cloud Security Professional (CCSP) Practice Question

ISO/IEC 17788 groups cloud services into three primary capability types:

• Application capability type (Software as a Service) - the provider delivers the full application stack and the consumer only configures limited application settings.
• Platform capability type (Platform as a Service) - the provider supplies a managed runtime and development environment (e.g., application servers, databases, container orchestration), while the consumer deploys and manages their own applications and data.
• Infrastructure capability type (Infrastructure as a Service) - the provider exposes raw compute, storage, and networking resources and the consumer installs and manages operating systems and middleware.

A managed Kubernetes service gives customers a ready-to-use orchestration platform (control plane, node lifecycle, networking, storage integration) but leaves the packaging, deployment, and operation of the containers and application logic to the customer. This exactly matches the platform capability type definition, making it the correct choice. The application capability type is incorrect because the provider is not delivering the complete application. Infrastructure capability type is incorrect because the provider is abstracting away significant infrastructure management tasks (e.g., control plane maintenance). Function capability type (FaaS) is not one of the three primary capability types defined in ISO/IEC 17788 and, in any case, hides the container platform from the customer rather than exposing it.