SY0-701 Security Architecture Practice Question
A team is moving a workload to infrastructure as a service (IaaS). Which two items are usually the customer's responsibility? Select two.
⚠ Common exam trap
A common mix-up: candidates confuse IaaS with PaaS or SaaS, mistakenly thinking the provider handles all OS-level patching, but in IaaS, the customer retains full control and responsibility for the guest OS and application configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Patch the guest operating system running on the cloud virtual machine.
In an IaaS model, the customer is responsible for managing the guest operating system, including applying security patches and updates. This is because the cloud provider only manages the underlying physical infrastructure and hypervisor, while the customer controls the OS and applications running on the virtual machine.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Patch the guest operating system running on the cloud virtual machine.
Why this is correct
In IaaS, the customer retains responsibility for the guest OS, including applying security patches and kernel updates, because the cloud provider only delivers virtualized compute resources rather than a managed platform. Unpatched guest OSes are a leading exploitation vector, as known CVEs in services like SSH or web servers can be trivially attacked from the network. The provider manages the host and hypervisor, but not the OS running inside the VM, so patching is squarely on the customer.
- ✗
Replace failed power supplies in the cloud provider's data center.
Why it's wrong here
Under the IaaS shared responsibility model, the provider operates and maintains the physical data center, including redundant power delivery, generators, and the replacement of failed power supplies. Customers interact only with virtualized resources and have no access to or accountability for physical hardware components. This task falls under the provider's environmental and physical security responsibilities, not the customer's workload management.
- ✓
Configure the application's user permissions and access settings.
Why this is correct
Even when the infrastructure is IaaS, the customer must configure identity and access management within the application, such as role-based access controls, least-privilege policies, and authentication settings. Misconfigured application permissions are a frequent cause of data breaches because they allow unauthorized users to access APIs, dashboards, or data even if the underlying infrastructure is secure. The provider cannot set or enforce these application-level permissions on behalf of the customer, so this remains a customer duty.
- ✗
Maintain the cloud provider's hypervisor firmware.
Why it's wrong here
The hypervisor, which mediates access between the virtual machines and the physical server, is part of the provider's managed host stack in IaaS. Updating hypervisor firmware or software affects all tenants on that host and requires privileged access to host-level management interfaces that the customer is deliberately not given. The provider handles these updates to ensure multi-tenant isolation and separation of duties, so customers must not attempt to maintain the hypervisor.
- ✗
Manage the physical firewall blades inside the provider's facility.
Why it's wrong here
The physical firewall blades located at the provider's network edge are managed by the provider as part of the shared networking infrastructure, similar to routers and switches in the provider's data center. IaaS customers can control virtual network security, such as security groups or VPC network ACLs, but they cannot manage or patch the provider's physical firewall hardware. Provider-owned devices are operated transparently to ensure network segmentation and perimeter defense, making this task the provider's responsibility.
Go deeper
Related to this question
Learn chapter
Cloud Security Fundamentals
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Hypervisor
A hypervisor is software that creates and runs virtual machines by allowing multiple operating systems to share a single hardware host.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.