SY0-701 Security Architecture Practice Question
A company moves a Linux server to infrastructure as a service (IaaS). Which task remains the customer's responsibility?
⚠ Common exam trap
Watch out — candidates often confuse IaaS with PaaS or SaaS, assuming the provider patches the OS, but in IaaS the customer retains full control and responsibility for the guest operating system and applications.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Patching the guest operating system and installed applications.
In an IaaS model, the cloud provider manages the physical infrastructure, hypervisor, and network backbone, while the customer retains responsibility for securing and maintaining the guest operating system and any installed applications. This includes applying security patches, updating software, and configuring the OS-level firewall. For a Linux server, the customer must run commands like `apt update && apt upgrade` or `yum update` to patch the OS and manage application dependencies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Patching the guest operating system and installed applications.
Why this is correct
This is the best answer because in IaaS the customer still manages the guest operating system and the software running on it. The cloud provider handles the underlying physical infrastructure, but the customer is responsible for keeping the VM patched and hardened. That distinction is a key part of the shared responsibility model.
- ✗
Replacing failed power supplies in the data center.
Why it's wrong here
In an IaaS environment, the cloud provider owns and operates the physical data center, including all hardware components that make compute possible. Replacing a failed power supply is a facility-level maintenance task that falls squarely on the provider's engineering and operations team, not the tenant. The customer's responsibility begins at the guest operating system and installed applications, which is why any physical hardware repair is outside the customer's scope. Even if a power supply failure caused a VM outage, the customer would only observe the effect, not participate in the remedy.
- ✗
Maintaining the hypervisor on the host system.
Why it's wrong here
The hypervisor is the virtualization layer that instantiates and isolates virtual machines on a host, and it is entirely managed by the cloud provider. A tenant does not receive access to the hypervisor console or its update processes, because the provider must maintain consistent patching and configuration to preserve security and multi-tenant isolation. If a customer attempted to maintain the hypervisor, they would bypass the provider's management plane and violate the architectural boundary of IaaS. Thus, hypervisor maintenance remains a provider responsibility, separate from the guest OS patching that the customer must perform.
- ✗
Building and securing the provider's network backbone.
Why it's wrong here
The provider's network backbone comprises the physical routers, switches, and fiber infrastructure that connect data centers and regions, and it is wholly owned and administered by the provider. Customers only configure virtualized networking components such as VPCs, subnets, route tables, and security groups within their tenant boundary. Securing the backbone involves centralized control over cryptographic protocols, BGP routing, and DDoS mitigation, which are inaccessible to individual tenants. Therefore, building and protecting that backbone is exclusively the provider's duty, whereas the customer secures their own virtual network configuration and workloads.
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
Hypervisor
A hypervisor is software that creates and runs virtual machines by allowing multiple operating systems to share a single hardware host.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A team runs a confidential document repository on an IaaS virtual machine. The cloud provider secures the datacenter, hardware, and hypervisor. Which task remains the organization’s responsibility?
medium- A.Patching the physical hosts inside the cloud provider's datacenter.
- B.Replacing the provider's hypervisor when a new version is released.
- ✓ C.Hardening the guest operating system and controlling access to the repository application.
- D.Managing the cloud provider's physical badge access for the server room.
Why C: In an IaaS model, the cloud provider is responsible for the security of the cloud (physical datacenter, hardware, hypervisor), while the customer is responsible for security in the cloud. This includes hardening the guest OS, configuring firewalls, managing access controls, and patching the operating system and applications. Option C correctly identifies the organization's duty to secure the guest OS and the repository application.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.