ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Under the SaaS model, the cloud provider is accountable for securing and maintaining the physical facilities, networking, servers, virtualization layer, and the SaaS application itself, including its patches. The customer, however, retains responsibility for the data they place in the service and for managing identities and associated permissions. Deciding who is granted or revoked access, defining roles, and enforcing authentication policies remain under the customer's purview. By contrast, server patching, data-center power and HVAC, and hypervisor maintenance are handled by the provider, as customers neither control nor manage those layers of the stack.