An attacker compromises a virtual machine in an IaaS environment through a vulnerability in the guest operating system that had a patch available for months. Under a typical shared responsibility model, who failed in their duty?
Select an answer to reveal the explanation.
Short Explanation
IaaS hands you a bare server in someone else's building. The provider keeps the building, power and hypervisor safe, but everything from the guest operating system up is yours. So if you left the guest OS unpatched, that one's on you.
Full Explanation
In IaaS, the provider supplies compute, storage and networking and secures the physical facilities, hardware and virtualization layer. The consumer deploys and controls the operating system, applications and data on the virtual machine, which NIST SP 800-145 describes as the consumer having control over operating systems and deployed applications. Patching the guest operating system is therefore the customer's responsibility, and an exploit through a long-available patch represents a customer failure. Providers do not patch customer virtual machines by default; they may offer optional tooling or managed services, but using those is a customer decision and does not change the default allocation. The hypervisor and the guest operating system are separate software layers with separate owners and update mechanisms; hypervisor patches protect the host and isolation boundary, not the software running inside the guest. Images are templates used to launch instances; running instances can be patched, and immutable infrastructure approaches still require the customer to rebuild images with current patches, which is again a customer task. Exam caveat: as you move toward PaaS and SaaS, the operating system shifts to the provider, so the service model determines the answer. Operational check: inventory IaaS instances, compare installed packages against vendor advisories with a vulnerability scanner, and enforce a patch or image rebuild cadence.