1. Mell, P., & Grance, T. (2011). The NIST Definition of Cloud Computing (NIST Special Publication 800-145). National Institute of Standards and Technology.
Section 2, "Essential Characteristics, Service Models, and Deployment Models": Defines IaaS as the capability where "The consumer is able to deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, and deployed applications; and possibly limited control of select networking components (e.g., host firewalls)." This directly supports option D.
2. Armbrust, M., Fox, A., Griffith, R., Joseph, A. D., Katz, R., Konwinski, A., ... & Zaharia, M. (2010). A view of cloud computing. Communications of the ACM, 53(4), 50-58. https://doi.org/10.1145/1721654.1721672
Page 51, "Classes of Utility Computing": The paper describes IaaS (using the term "Hardware-as-a-Service") as a model where users are given "raw virtualized hardware" on which they can "install any OS and application software." This reinforces the concept of user control over the OS and software stack, aligning with option D.
3. Microsoft Azure Documentation. (n.d.). What is Infrastructure as a service (IaaS)? Microsoft.
"IaaS vs. PaaS vs. SaaS" section: The documentation presents a chart showing that in IaaS, the customer manages "Applications," "Data," "Runtime," "Middleware," and "O/S." This contrasts with PaaS and SaaS, where the vendor manages more of these layers, explicitly demonstrating the control IaaS provides. This supports the reasoning for both the correct answer and the incorrectness of other options.