A city moves a virtual machine to Azure and assumes Microsoft now patches the guest OS and every application. Under the shared responsibility model for IaaS, which statement is correct?
Select an answer to reveal the explanation.
Short Explanation
Lift-and-shift does not mean "Microsoft babysits the guest OS." On IaaS, the provider minds the building and host; the city still patches the OS, apps, data, and who can sign in. Shared responsibility is a handoff of layers, not a vacation from security.
Full Explanation
Under the shared responsibility model for IaaS, Microsoft secures the physical facilities, host infrastructure, and related platform controls that customers cannot reach. The customer still secures the guest operating system, applications, data, and identities on virtual machines moved to Azure. Lift-and-shift therefore does not transfer guest patching, app hardening, or access governance to the provider.
Assuming Microsoft becomes solely responsible for every layer—including app passwords and data classification—overstates the provider’s IaaS role. Claiming the city only manages physical locks while Microsoft owns all OS and application security reverses the actual split. Saying neither party patches anything until an auditor files a ticket abandons continuous operational duty on both sides of the model.
Exam caveat: moving up to PaaS or SaaS shifts more platform work to Microsoft, but IaaS guest OS and app duties remain with the customer—do not apply a SaaS mental model to VMs. Operational check: after a municipal VM migration, confirm patch management, endpoint protection, backup of guest data, and identity controls are still assigned to city teams with clear owners and schedules.