MS-900 Describe cloud concepts Practice Question
A company uses Infrastructure-as-a-Service (IaaS) from a cloud provider. They have deployed virtual machines running a custom application. The cloud provider supplies the physical hardware, networking, and storage. Who is responsible for patching the operating system of the virtual machines?
⚠ Common exam trap
Watch out — candidates often confuse IaaS with PaaS or SaaS, assuming the cloud provider patches everything, but in IaaS the customer is explicitly responsible for the guest OS and applications.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The customer
In an IaaS model, the cloud provider is responsible for the physical infrastructure (hardware, networking, storage), but the customer retains responsibility for the guest OS and application stack. Patching the operating system of virtual machines is a customer task because the customer controls the OS image and has full administrative access to the VM. This follows the shared responsibility model where the provider secures the hypervisor and physical layer, while the customer secures the OS and applications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The cloud provider
Why it's wrong here
In the IaaS shared responsibility model, the cloud provider is accountable only for the physical data center, network infrastructure, and the hypervisor that isolates virtual machines. The provider does not log into your guest OS or patch the applications you deploy, so any compromise of the OS or application layer is not the provider's fault. Thus, saying 'the cloud provider' is incorrect because it incorrectly assigns guest-OS security duties to a party that lacks the access and contractual obligation to manage them.
- ✓
The customer
Why this is correct
The customer is the correct answer because IaaS delivers raw compute, storage, and networking, leaving the customer in full control of the guest OS, middleware, runtime, data, and applications. This means the customer must apply OS patches, configure firewalls, harden the system, manage user access, and protect workloads against malware and vulnerabilities. Under the shared responsibility model, this is a firm, non-transferable obligation for the IaaS consumer, even if some tasks are automated or delegated.
- ✗
Both the provider and the customer share equally
Why it's wrong here
Responsibility in IaaS is not an even 50/50 split; it is a layered division based on control. The provider secures the physical hosts, storage, and network fabric, while the customer secures everything it creates or installs in the guest VM, such as the OS, applications, and data. A true 'equal share' implies identical duties, but the actual boundary is clear: the provider manages the stack up to the hypervisor, and the customer manages from the guest OS upward.
- ✗
A third-party managed security service provider
Why it's wrong here
While a customer could hire a third-party managed security service provider (MSSP) to perform patching and monitoring, that engagement does not change the default responsibility contractually held by the customer. The cloud provider still looks only to the customer as the account owner; any MSSP acts as an agent of the customer, and the customer remains accountable for compliance, security outcomes, and any breaches. Therefore, the MSSP is not an inherent party in the IaaS shared responsibility model and is wrong as the direct answer.
Go deeper
Related to this question
About these practice questions
This MS-900 question is part of Courseiva's 794-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.