nerdexam
Palo_Alto_Networks

PCCET · Question #112

Who is responsible for the security settings in an enterprise SaaS application?

The correct answer is D. both IT administrators and users. In an enterprise SaaS application, security settings are a shared responsibility, with the customer's IT administrators managing organizational policies and individual users being responsible for their own secure usage.

Submitted by yuki_2020· Apr 18, 2026Cloud Security

Question

Who is responsible for the security settings in an enterprise SaaS application?

Options

  • ASaaS provider
  • BIT administrator of the customer organization
  • Cuser, typically an employee of the customer organization
  • Dboth IT administrators and users

How the community answered

(65 responses)
  • A
    2% (1)
  • B
    3% (2)
  • C
    5% (3)
  • D
    91% (59)

Why each option

In an enterprise SaaS application, security settings are a shared responsibility, with the customer's IT administrators managing organizational policies and individual users being responsible for their own secure usage.

ASaaS provider

While the SaaS provider is responsible for the security *of* the application and its underlying infrastructure, they do not manage the customer's specific security *settings* like user roles, permissions, or data configurations.

BIT administrator of the customer organization

IT administrators manage many security settings, but end-users also have responsibilities related to their own data, passwords, and actions within the application.

Cuser, typically an employee of the customer organization

Users have some security responsibilities (e.g., strong passwords, not sharing data), but IT administrators are typically responsible for broader security configurations and policies.

Dboth IT administrators and usersCorrect

IT administrators typically configure tenant-wide security policies, access controls, and integration settings within the SaaS application, while individual users are responsible for their own secure use, password hygiene, and adherence to company policies. This reflects the shared responsibility model in SaaS, where the provider handles the underlying infrastructure and application, but the customer retains responsibility for configuration and usage.

Concept tested: SaaS shared responsibility model

Source: https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility

Topics

#SaaS security#Shared responsibility model#Admin responsibilities#User responsibilities

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PCCET Practice