In which two cloud computing service models are the vendors responsible for vulnerability and patch management of the underlying operating system? (Choose two.)