A parks portal will run as PaaS web apps, and staff argue that nobody needs to think about security anymore. What remains a customer duty under shared responsibility for PaaS?
Select an answer to reveal the explanation.
Short Explanation
PaaS takes more of the platform off your plate, not your keys to the data. Staff still decide who gets in, how the app is configured, and how citizen data is protected. "Nobody thinks about security" is the wrong takeaway.
Full Explanation
Platform as a service reduces customer work on the underlying hosts and runtime compared with IaaS, but it does not erase security ownership. For PaaS web apps such as a parks portal, data protection, identity and access decisions, and application configuration remain customer responsibilities. Staff still decide who can sign in, how roles are assigned, how secrets are handled, and how the application is configured.
Saying only physical datacenter cameras remain a customer duty invents an impossible municipal task and ignores real customer controls. Requiring customers to rack and stack PaaS host servers inside each Azure region describes work Microsoft performs for PaaS, not the customer. Claiming PaaS transfers all security—including data access and app settings—entirely to the provider is the misconception the scenario warns against.
Exam caveat: the exact customer surface varies by PaaS service, but identity, data, and app configuration nearly always stay on the customer side. Operational check: review the parks portal’s Entra ID (or equivalent) assignments, app settings, network access rules, and data classification labels before go-live, and document who owns each control. In practice, treat PaaS as “less OS babysitting, same duty of care for citizen data,” and keep a short RACI that names the application owner for configuration changes and the identity owner for role assignments before the portal goes live to the public.