CV0-004 Security Practice Question
A cloud customer is deploying a virtual machine (VM) in a public IaaS environment. According to the shared responsibility model, which of the following security tasks is the customer responsible for?
⚠ Common exam trap
CV0-004 often tests the misconception that the cloud provider handles all security tasks, leading candidates to incorrectly select physical security or hypervisor protection as customer responsibilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Patching the guest operating system
In the shared responsibility model for IaaS, the cloud provider is responsible for the security 'of' the cloud (physical security, hypervisor, network infrastructure), while the customer is responsible for security 'in' the cloud. Patching the guest operating system is a customer task because the customer has full control over the VM's OS, including updates, configuration, and application security. This aligns with the principle that the customer manages everything from the OS up, while the provider manages the virtualization layer and below.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Securing the hypervisor
Why it's wrong here
The hypervisor sits beneath the guest VM, so the IaaS provider patches and hardens it; the customer only secures what runs inside the VM. It tempts because private-cloud or on-premises virtualisation places hypervisor hardening squarely on the infrastructure owner.
- ✓
Patching the guest operating system
Why this is correct
In IaaS, the provider secures the physical hosts, hypervisor and network fabric, while the customer owns everything above it, including the guest operating system. Patching that guest OS therefore falls to the customer, satisfying the shared responsibility split for this deployment.
- ✗
Physical security of the data center
Why it's wrong here
Physical data centre security belongs to the provider in IaaS; the customer secures the guest OS, applications, data and identity. It is tempting because customers do control some physical-adjacent concerns, such as hardware security modules, but not the facility itself.
- ✗
Network infrastructure integrity
Why it's wrong here
Physical network fabric, routers and switches remain the provider's domain in public IaaS, so the customer cannot own this task. It tempts because on-premises deployments make the tenant fully accountable for cabling and core network hardware, which is exactly when this answer would be right.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CV0-004 question from scratch — 834 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.