Fran$$s organization uses a Type I hypervisor to implement an IaaS offering that it sells to customers. Which one of the following security controls is least applicable to this environment?

Group of answer choices

A$.$ Customers must maintain security patches on guest operating systems.

B$.$ The provider must maintain security patches on the hypervisor.

C$.$ The provider must maintain security patches on the host operating system.

D$.$ Customers must manage security groups to mediate network access to guest operating systems.