AZ-900 Question 157

In the shared responsibility model, who is responsible for patching the guest operating system in an IaaS solution?