Question

A retail company migrates its e-commerce application to Compute Engine virtual machines (an IaaS model). During a security review, the team debates who is responsible for keeping the guest operating system and installed application libraries patched and up to date. Under the shared responsibility model for IaaS on Google Cloud, who is responsible for these tasks?

Accepted Answer

The customer is responsible for patching the guest OS and application libraries, while Google secures the underlying hardware and hypervisor.

Answer

Google is fully responsible for patching the guest OS and the application libraries.

Answer

Neither party is responsible; patching is optional in a cloud environment.

Answer

Google patches the application libraries, and the customer patches only the physical servers.