CCSP Cloud Concepts, Architecture, and Design Practice Question
In the shared responsibility model for public cloud, which of the following is typically the responsibility of the cloud customer when using IaaS?
⚠ Common exam trap
CCSP often tests the boundary between provider and customer responsibilities; the trap is assuming the provider patches everything, when in IaaS the guest OS is explicitly the customer's job.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Patch management of the guest operating system
In the IaaS shared responsibility model, the cloud provider secures the physical infrastructure, hypervisor, and network fabric, while the customer is responsible for everything from the guest OS upward — including OS patching, middleware, runtime, applications, and data. Patch management of the guest operating system (C) is therefore squarely the customer's duty. This is a defining characteristic of IaaS versus PaaS or SaaS, where the provider assumes more of the stack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Network firewall configuration at the hypervisor level
Why it's wrong here
Hypervisor-level firewalls sit with the provider, who owns the virtualisation layer. The customer configures host-based firewalls and security groups inside their own instances. This option tempts because firewalls are a familiar customer control, and in PaaS or SaaS the boundary shifts, but under IaaS the hypervisor remains provider-managed.
- ✗
Physical security of data centers
Why it's wrong here
Physical security of data centres remains with the cloud provider under IaaS, since the customer never controls the hardware or facilities. It tempts because physical controls are a genuine customer duty in on-premises and colocation deployments, where the organisation owns or leases the building and its perimeter, power and access controls.
- ✓
Patch management of the guest operating system
Why this is correct
In IaaS the provider secures the physical hosts, network, and hypervisor, while the customer retains control of everything from the guest operating system upward. Patching that guest OS, including its installed software and security updates, therefore falls to the customer.
- ✗
Storage device maintenance
Why it's wrong here
Storage device maintenance sits with the cloud provider under IaaS, since the provider owns and services the physical hardware in its data centres. It tempts because storage administration feels like a customer task, and it would be correct for on-premises deployments or where the customer manages dedicated hardware.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.