Question

A company migrates its application servers to a public cloud provider using an Infrastructure as a Service (IaaS) model. During a security review, the team debates who is responsible for applying operating system security patches on those virtual machines. According to the shared responsibility model, who is responsible?

Accepted Answer

The customer, because operating system maintenance falls to the customer under IaaS

Answer

The cloud provider, because it owns and maintains all underlying infrastructure

Answer

The cloud provider, because patching is always a provider obligation regardless of service model

Answer

A third-party auditor, because patch validation is an external compliance function