ISC2 Certified Cloud Security Professional (CCSP) Practice Question

NIST's reference architecture groups services into capability types. A platform capability type (commonly delivered as PaaS) abstracts the underlying infrastructure and operating system from the customer. The provider maintains the OS, runtime, middleware, and often database engines, while the customer retains control over the deployed application code and its data. This aligns with the team's desire to deploy their own WAR files yet avoid managing VMs, patches, or middleware. An application capability type (SaaS) would remove even code-deployment control, while an infrastructure capability type (IaaS) or bare-metal offering would still make the customer responsible for OS and middleware management. Therefore, the platform capability type is the correct choice.