ISC2 Certified Cloud Security Professional (CCSP) Practice Question

In the NIST Cloud Computing Reference Architecture, the cloud provider supplies and manages the cloud infrastructure that supports the service, including the physical servers and the virtualization (hypervisor) layer. Even when a customer provisions and manages its own virtual machines under an IaaS model, the hypervisor itself remains under the operational and security control of the cloud provider.

The cloud consumer is responsible only for the guest operating systems, applications, and data within the VMs it provisions. A cloud broker may facilitate service selection or aggregation but does not operate the provider's infrastructure. A cloud auditor performs independent assessments and likewise does not administer infrastructure components. Therefore, the cloud provider is the correct role.