Question

A company migrates a fleet of Linux virtual machines to a public cloud provider using an IaaS model. During a security audit, the team must document which operating system and application patching tasks are their responsibility versus the provider's. Under the standard IaaS shared responsibility model, who is responsible for applying guest OS and application-level security patches?

Accepted Answer

The customer is responsible for patching the guest OS and applications, while the provider maintains the hypervisor and physical infrastructure.

Answer

The cloud provider is responsible for all patching, including the guest OS and applications running in the VMs.

Answer

The customer patches only the physical hardware firmware, while the provider handles the guest OS and applications.

Answer

Patching is fully automated by the provider under IaaS, so neither party has explicit responsibility.