A vulnerability scan of an IaaS virtual machine running a customer's web application reports missing operating system security patches that were released two months ago. Under the shared responsibility model, which party is responsible for applying them?
Select an answer to reveal the explanation.
Short Explanation
Renting an empty apartment means the landlord fixes the building, but you maintain whatever you move in, and in IaaS you move in the whole operating system. Guest OS patches are yours. The trap is the base image: the provider handing you a starting point doesn't make it the maintainer.
Full Explanation
In Infrastructure as a Service the provider is responsible for the physical facilities, hardware, network and virtualization layer. The customer deploys and controls the guest operating system, middleware, applications and data, so patching the guest OS falls to the customer. The two-month-old missing patches are a customer process gap, not a provider failure. A provider-supplied base image is a starting point; once the customer launches an instance from it, maintaining that instance is the customer's job, and the provider does not patch running customer instances. IaaS does not include operating system patching as part of the standard service; that kind of management is what distinguishes PaaS and managed services from IaaS. Splitting the guest OS so that the provider patches the kernel and the customer patches applications describes no standard IaaS arrangement; the kernel is part of the guest operating system the customer controls. Exam caveat: some providers offer optional patch management tools or managed OS services, but using them is the customer's choice and responsibility unless a contract explicitly says otherwise. Operational check: confirm the customer's patch management process covers every IaaS instance, track mean time to patch against policy, and rebuild instances from updated images where immutable deployment is used.