Exam CAS-004 topic 1 question 641 discussion

🏗️ Shared Responsibility Model (in PaaS): Component Responsibility Physical infrastructure CSP OS, platform, middleware CSP App code, data, and configurations CRM company (SaaS vendor) So when the question specifies "infrastructure components" under a PaaS model, the CSP is responsible for ensuring that these components meet regulatory requirements — not the CRM company directly.

The correct answer is A. The CRM company. In a Platform as a Service (PaaS) model, the cloud service provider (CSP) is responsible for managing the underlying infrastructure and platform, but the CRM company (the SaaS provider) is responsible for ensuring that the application and its configuration meet the specific regulatory requirements of their customers. These regulatory requirements typically cover aspects such as configuration management, patch management, and life-cycle management, which are critical for maintaining compliance with industry-specific regulations (e.g., HIPAA, GDPR, PCI DSS). Even though the CSP handles the infrastructure, the CRM company, as the SaaS provider, is responsible for ensuring that its use of the platform complies with those regulations, especially in terms of how they configure, manage, and operate their application.