Infrastructure as a Service and Platform as a Service is correct because both service models commonly place responsibility for applying software patches on the cloud customer for the software they install and manage.

With IaaS the provider supplies virtualized compute, storage, and networking while the customer installs and maintains guest operating systems, middleware, and applications. The customer therefore must patch the OS and application software running on IaaS virtual machines.

With PaaS the provider manages the underlying host OS and runtime platform but the customer is responsible for their application code and any frameworks or libraries they add. That means the customer must apply patches for their applications and components that the platform does not fully manage.

Platform as a Service only is incorrect because the expectation to patch customer-managed software also exists for IaaS so selecting PaaS alone is incomplete.

Google Cloud managed services is incorrect because managed services are an implementation detail and responsibilities vary by service. Many managed services include provider patching so this option is not a general cloud service model to use for the exam question.

Infrastructure as a Service only is incorrect because although IaaS customers do handle OS and application patching the same customer responsibility also applies to PaaS for application level patches so the correct answer must include both models.

Software as a Service only is incorrect because SaaS providers deliver and manage the full application stack and they are typically responsible for applying patches to the software and the underlying infrastructure.

Full AWS Practitioner Certification Question