Cloud Shared Responsibility: OS Patching in IaaS vs PaaS

350-701 By islever Editorial Last updated

Describe security responsibility within common Cloud Shared Responsibility Models

Short answer

B Platform as a Service is selected because the service provider manages the operating system, relieving the customer of patching duties.

Question

An organization is selecting a cloud architecture and does not want to be responsible for patch management of the operating systems. Why should the
organization select either Platform as a Service or Infrastructure as a Service for this environment?
  1. Infrastructure as a Service because the customer manages the operating system.
  2. Platform as a Service because the service provider manages the operating system. Correct Answer
  3. Infrastructure as a Service because the service provider manages the operating system.
  4. Platform as a Service because the customer manages the operating system.

Key Takeaways

The exam often traps candidates on who owns the OS; remember that in PaaS, the vendor manages the OS stack, whereas in IaaS, the customer does.

This question tests the cloud shared responsibility model, specifically who manages operating system patching. Platform as a Service (PaaS) is the correct choice because the provider handles the underlying OS.

Common mistake: Candidates frequently choose Infrastructure as a Service (IaaS), mistakenly believing that moving to the cloud automatically offloads all infrastructure management, including the guest OS.

Expert Analysis

Why the Answer Is Correct

Platform as a Service (PaaS) provides a platform allowing customers to develop, run, and manage applications without the complexity of building and maintaining the infrastructure typically associated with developing and launching an app. In a PaaS model, the service provider manages the hardware, operating system, middleware, and runtime, leaving the customer to focus solely on the application data and code. Therefore, if an organization wants to avoid OS patching, PaaS is the ideal selection.

Why the Other Options Are Wrong

Infrastructure as a Service (IaaS) provides virtualized computing resources over the internet. While the provider manages the physical hardware and hypervisor, the customer is responsible for managing the guest operating system, including security patches and updates. Options claiming the provider manages the OS in IaaS are factually incorrect regarding the standard shared responsibility model.

Community Comment Notes

Community feedback confirms this distinction. As one commenter noted, "PaaS builds on the IaaS model... Cloud providers... host and manage operating systems." This reinforces that PaaS abstracts away the OS layer for the consumer.

Exam Strategy

Memorize the boundary lines between IaaS, PaaS, and SaaS. A good rule of thumb is that as you move up the stack from IaaS to SaaS, the customer's responsibility decreases. If the question asks about avoiding OS management, look for PaaS or higher.

Frequently Asked Questions

Does IaaS ever include OS patching?

No, in standard IaaS, the customer is responsible for the guest OS patching. Some managed services exist, but they are not standard IaaS.

What does the provider manage in PaaS?

The provider manages the physical hardware, virtualization layer, operating system, and middleware. The customer manages the application and data.

More 350-701 FAQ →

Discussion 1 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 1

  1. XBfoundX 👍 1 Answered B
    Platform-as-a-Service (PaaS) PaaS builds on the IaaS model, but is usually specific to hardware and software tools for application development. Cloud providers, in addition to providing infrastructure components, also host and manage operating systems and middleware that your developers need to create and run applications. PaaS offers an on-demand, pay-as-you-go model.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

← Back to 350-701 Study Guide