CCSP Cloud Concepts, Architecture, and Design Practice Question
In a public cloud IaaS environment, which of the following is the customer responsible for securing, according to the shared responsibility model?
⚠ Common exam trap
The trap is over-attributing security to the cloud provider; candidates often think the provider secures the OS because it secures the hypervisor, but in IaaS the guest OS is squarely the customer's responsibility.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Operating system and applications
In the IaaS shared responsibility model, the cloud provider secures the physical facilities, hardware, hypervisor, and network fabric, while the customer is responsible for everything from the guest operating system upward, including patching, applications, and data. Therefore the customer must secure the operating system and applications they deploy on IaaS instances.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Operating system and applications
Why this is correct
In IaaS the provider secures the physical hosts, network and hypervisor, while the customer retains responsibility for everything above it: guest operating system patching, middleware, applications and data. That division satisfies the stem's IaaS shared responsibility question.
- ✗
Virtualization hypervisor
Why it's wrong here
The hypervisor sits below the customer's control boundary; the cloud provider secures and patches it. It is tempting because customers do secure the guest operating systems and applications running above it, but the hypervisor itself would fall to the customer only in a private, self-managed virtualisation deployment.
- ✗
Network infrastructure
Why it's wrong here
In IaaS the provider secures the physical network fabric, hypervisor and virtual networking, while the customer secures guest OS, applications and data. Network infrastructure is tempting because customers configure security groups and virtual firewalls, but the underlying physical routers, switches and links remain the provider's responsibility.
- ✗
Physical security of data centers
Why it's wrong here
Physical security of data centres stays with the cloud provider under every service model, including IaaS. It is tempting because customers retain broad control over guest systems, yet they never control buildings, cages, biometric access or hardware disposal, so this cannot be a customer obligation.
About these practice questions
Courseiva writes every CCSP question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.