Under the shared responsibility model, which statement correctly matches provider and customer responsibilities in IaaS?

• A. Provider handles OS and applications; Customer handles virtualization
• B. Provider handles physical infrastructure and virtualization; Customer handles OS, applications, and data
• C. Provider handles data security only; Customer handles network control
• D. Provider handles user management and access; Customer handles billing

Answer: (B)

In IaaS, the provider is responsible for the physical infrastructure and the virtualization layer that runs the virtual machines—essentially the hardware, data center facilities, networking, and the hypervisor. The customer is responsible for everything inside the virtual machines: the guest operating system, any installed software, and the data those systems handle, including patching the OS, configuring security controls, managing users and access, and protecting data at rest and in transit. This division is what makes the statement correct: the provider covers physical infrastructure and virtualization, while the customer handles the OS, applications, and data.