CAS-004 Security Architecture Practice Question
In a cloud shared responsibility model, which of the following is typically the customer's responsibility for IaaS?
⚠ Common exam trap
The trap is confusing the responsibilities across service models; candidates may think the cloud provider patches the guest OS in IaaS, but the exam expects knowledge that the customer is responsible for guest OS patching in IaaS, while the provider handles the hypervisor and physical security.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Guest OS patch management
In the cloud shared responsibility model for IaaS, the customer is responsible for managing the guest operating system, including patch management, security updates, and configuration. The cloud provider is responsible for the hypervisor, hardware, and physical security of data centers. Therefore, guest OS patch management is the customer's responsibility.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hypervisor security
Why it's wrong here
Hypervisor security sits with the cloud provider, who owns and patches the virtualisation layer beneath every tenant VM. It is tempting because hypervisor escapes are a genuine IaaS threat, but that risk is mitigated provider-side, not by the customer.
- ✓
Guest OS patch management
Why this is correct
Under IaaS, the provider secures the hypervisor, physical hosts and network fabric, while the customer retains control of everything from the guest OS upward. Patching the guest operating system therefore remains the customer's duty, unlike managed PaaS where the provider handles runtime patching.
- ✗
Hardware maintenance
Why it's wrong here
Hardware maintenance belongs to the provider, who owns the physical hosts and replaces failed components. It is tempting because customers still patch guest operating systems, yet that duty covers software inside the VM, never the underlying servers.
- ✗
Physical security of data centers
Why it's wrong here
Physical data centre security is the provider's responsibility, since the customer has no access to those facilities. It is tempting because data protection feels like a customer concern, but physical controls such as guards, locks and cameras remain entirely provider-operated in IaaS.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 973-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.