A mayor assumes that moving municipal virtual machines to the cloud means the provider now patches every guest OS and every city application. Under a typical IaaS shared-responsibility model, what remains the city's responsibility?
Select an answer to reveal the explanation.
Short Explanation
Moving the VMs is like renting an apartment building—the landlord keeps the lobby and structure safe, but you still lock your unit and maintain what is inside. On IaaS the provider handles facilities and host; the city still patches guest OS, apps, data, and identities. The mayor’s assumption skips that apartment-level work.
Full Explanation
Under a typical IaaS shared-responsibility model, the provider secures physical facilities, power, networking fabric, and the hypervisor host layer, while the municipal customer retains responsibility for guest operating systems, applications, data, and identity configuration. Moving city virtual machines into the cloud does not by itself transfer guest patching or application security to the provider. Assuming the city only cares about datacenter doors and generators is wrong because those physical controls are provider-side; the mayor’s concern about guest OS and apps remaining unpatched is exactly what the city must still own. Claiming that nothing remains after cutover is a dangerous misconception that IaaS offloads all security. Limiting city duty to public DNS alone ignores guest hardening, application updates, encryption, and access control. Exam caveat: Cloud+ emphasizes that lift-and-shift to IaaS moves location, not ownership of the guest stack—shared responsibility is not “provider does everything.” Operational check: inventory every migrated municipal VM, assign patch owners for guest OS and apps, enable configuration baselines and vulnerability scanning, and document identity and data-protection controls in the city’s IaaS responsibility matrix before go-live.