AZ-900 Question 116

Must the customer remain responsible for patching the guest operating system on Azure Virtual Machines under the IaaS shared responsibility model?