Software as a Service with customer managed keys is the correct option.

The vendor hosted application model still applies while the customer retains sole control of the cryptographic keys when using Software as a Service with customer managed keys. In this arrangement the software provider runs and maintains the application and the customer supplies and controls the encryption keys in their own key management system or a supported customer managed key service.

Because the keys are customer managed the customer can rotate, revoke, and audit key usage independent of the SaaS provider. This gives the fintech startup the cryptographic control it needs for data protection while avoiding responsibility for hosting and operating the application stack.

Platform as a Service with additional security controls is incorrect because PaaS requires the customer to manage more of the platform and application runtime than a vendor hosted SaaS solution. PaaS is not the typical model where the vendor fully operates the application for the customer.

Custom Infrastructure as a Service is incorrect because a custom IaaS model means the customer manages infrastructure components such as virtual machines and operating systems. That model does not match the requirement to run vendor hosted applications while retaining only the keys.

Standard Software as a Service is incorrect because standard SaaS usually uses provider managed keys and does not give the customer sole control of cryptographic keys. The distinction in the correct answer is the customer managed key option which changes who controls the encryption keys.

Full AWS Practitioner Certification Question