SSCP Systems and Application Security Practice Question
An organization uses Infrastructure as a Service (IaaS) in the public cloud. Which of the following security responsibilities is the customer responsible for?
⚠ Common exam trap
The trap is assuming the provider patches everything in IaaS — candidates forget that the customer owns the guest OS, so OS patching remains a customer duty even though the hypervisor is provider-managed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Operating system security and patch management
In IaaS, the customer is responsible for securing the operating system, including patch management, because the provider only manages the hypervisor and physical infrastructure. Operating system security and patching is therefore a customer responsibility. The other options are provider responsibilities in IaaS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Network infrastructure security
Why it's wrong here
Under IaaS the provider owns the physical network fabric, routers, and switches; the customer secures traffic through controls such as security groups, NACLs, and encryption. Customer responsibility for network infrastructure security arises with on-premises networking or self-managed network appliances.
- ✗
Hypervisor security and patching
Why it's wrong here
The cloud provider, not the customer, secures and patches the hypervisor, since it sits beneath the virtualisation boundary the customer never administers. Customers would own hypervisor hardening only when running their own hypervisor on-premises or on bare metal they manage.
- ✓
Operating system security and patch management
Why this is correct
In IaaS the provider secures the physical hosts, hypervisor and network fabric, but the guest operating system remains the customer's layer. Patching, hardening and OS-level controls therefore fall to the customer, satisfying the stem's IaaS responsibility split.
- ✗
Physical security of the data center
Why it's wrong here
Physical security of data centres remains with the cloud provider under every service model, including IaaS, because customers have no access to the facilities. Customer responsibility for physical security applies to on-premises hardware or colocation cages the organisation itself operates.
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.