SY0-701 Security Architecture Practice Question
A team deploys an e-commerce application on an IaaS virtual machine. The cloud provider secures the datacenter, hardware, and hypervisor. The company wants to reduce the chance that attackers exploit outdated software on the VM itself. Which responsibility remains with the company?
⚠ Common exam trap
Candidates often confuse the shared responsibility model: candidates often assume the provider handles all security (including OS patching) because they secure the hypervisor, but in IaaS, the customer retains full responsibility for the guest OS and applications.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Patch and harden the guest operating system and application running on the VM.
In an IaaS model, the cloud provider is responsible for the security of the cloud (datacenter, hardware, hypervisor), while the customer is responsible for security in the cloud. This includes patching and hardening the guest OS and application on the VM. The company must manage vulnerabilities in the software stack it controls to prevent exploitation of outdated components.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Replace the cloud provider’s physical security controls with on-site guards.
Why it's wrong here
Physical security for the datacenter is part of the provider’s responsibility in this model. The company cannot practically replace that control inside the IaaS service, and it does not address software vulnerabilities on the guest VM.
- ✓
Patch and harden the guest operating system and application running on the VM.
Why this is correct
In IaaS, the organization is responsible for the guest OS and everything above it, including applications and configuration. If attackers may exploit outdated software on the VM, the company must handle patching, hardening, and secure configuration of that environment.
- ✗
Install new firmware on the physical host server maintained by the provider.
Why it's wrong here
In the IaaS shared responsibility model, the cloud provider is responsible for the physical host, hypervisor, and firmware, while the customer only manages the guest OS and above. A customer cannot install firmware on the provider-owned host because they have no direct administrative access to that underlying infrastructure, and doing so could disrupt multi-tenant services. The vulnerability described is in the guest VM's OS or application, not in host firmware, so this action does nothing to reduce the risk.
- ✗
Set the data center’s perimeter access badge policy.
Why it's wrong here
Physical security controls such as data center badge access are the sole responsibility of the cloud provider in an IaaS deployment, and the tenant typically cannot modify those policies. Even if the company could reconfigure the badge system, it is a facility-level control that does not address an outdated guest operating system or application on the VM. The exploitable flaw is a software vulnerability inside the VM, which requires patching and hardening, not a change in physical access rules.
Go deeper
Related to this question
Learn chapter
Cloud Security Fundamentals
Key term
Hypervisor
A hypervisor is software that creates and runs virtual machines by allowing multiple operating systems to share a single hardware host.
Key term
Hardening
Hardening is the process of securing a computer system or network by reducing its attack surface, disabling unnecessary services, and applying security configurations.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.