A national retailer runs its ordering application on cloud virtual machines. The retailer patches the guest operating system and the application. The provider owns the hosts, storage, and hypervisor. Which NIST service model is this?
Select an answer to reveal the explanation.
Short Explanation
Look at who still carries the toolbox for the operating system. You patch the guest, so the provider sold you infrastructure, not a finished application and not a platform that hides the OS. Where the building sits does not change the model.
Full Explanation
NIST 800-145 separates service models by which layers the customer still operates. In Infrastructure as a Service the customer manages the guest operating system, middleware, and application, while the provider manages the underlying hosts and hypervisor. That is the retailer's split of duties. Software as a Service means the customer uses the provider's application and does not patch the operating system under it. Running in a provider building is not what makes a service SaaS. Platform as a Service lets the customer deploy applications without managing the guest OS. Not buying the physical servers is true of several models and does not by itself mean PaaS. A community cloud is a deployment model, a cloud shared by a community of organizations, not a service model. Several store brands of one retailer do not define the NIST service model. Caveat: if the retailer later stops patching the OS and only configures the application on a provider runtime, the same app may move to PaaS, so the answer follows the operating split, not the product name. Operational check: list who patches the guest image versus who owns the hypervisor, and match that split to IaaS before you write the control responsibilities down.