ISC2 Certified Cloud Security Professional (CCSP) Practice Question

In a Platform as a Service (PaaS) offering, the cloud provider assumes responsibility for managing and securing the underlying infrastructure, hypervisor, host operating system, and platform middleware-including patching and hardening those components. Physical security of the data center is also entirely within the provider's domain. However, customers retain full responsibility for anything they deploy or create on top of the platform. That includes their data and the security of their own application code. Implementing secure development practices-such as proper input validation, output encoding, and other application-layer controls-remains the customer's obligation because only the customer can embed these controls within the software they build. The provider cannot secure code it does not author. Therefore, implementing input validation and other secure coding controls in the application source code is the correct choice, while the other tasks fall under the provider's duties in a PaaS environment.