Question

A software company migrates its customer-facing web application to a Platform as a Service (PaaS) offering. The cloud provider manages the operating system, runtime, middleware, and underlying infrastructure. During a security review, the team discovers a SQL injection vulnerability in the application's input handling. Under the shared responsibility model for PaaS, who is responsible for remediating this vulnerability?

Accepted Answer

The customer, because application code and data remain the customer's responsibility in PaaS

Answer

The cloud provider, because they manage the runtime and middleware that execute the application

Answer

The cloud provider, because SQL injection targets the database engine they operate

Answer

Responsibility is fully shared equally between the provider and customer for all application-layer flaws