A development operations team would like to start building new applications delegating the cybersecurity responsibility as much as possible to the service provider. Which of the following environments

Cloud VMs (IaaS) still require the customer to manage OS patching, security configurations, and application security, leaving more cybersecurity responsibility with the team.

A cloud application container within a VM delegates the most cybersecurity responsibility to the service provider compared to the other options. The provider manages the underlying infrastructure, hypervisor, host OS, and VM security, while containers abstract away much of the OS-level management. This approach follows the shared responsibility model where moving toward PaaS/CaaS shifts more security obligations to the cloud provider, letting the dev team focus on application development.

On-premises VMs place nearly all cybersecurity responsibility on the organization, including physical security, network security, hypervisor, OS, and application layers.

Self-hosted VMs, like on-premises solutions, require the organization to manage the full security stack, providing no delegation of cybersecurity responsibility to a service provider.