Who Is Responsible for Encrypting Data in Memory in Azure PaaS?
A company migrates its web application to Azure App Service (Platform as a Service). The application processes sensitive customer data and must ensure that all data in memory is encrypted while the application is running. According to the shared responsibility model, which party is responsible for implementing encryption of data in memory for this application?
Quick Answer
The answer is the company, because under the shared responsibility model for PaaS, data encryption in memory falls squarely on the customer. While Microsoft secures the physical infrastructure, hypervisor, and Azure App Service runtime, it cannot access or manage the application’s memory space—encrypting data in memory requires code-level implementation, such as using .NET’s `ProtectedMemory` or Windows DPAPI, which only the customer can control. On the AZ-900 exam, this question tests your understanding of the boundary between “security of the platform” (Microsoft) and “security in the platform” (you). A common trap is assuming PaaS means Microsoft handles all encryption, but remember: encryption at rest and in transit often involves shared responsibility, whereas encryption in memory is always the customer’s domain. Memory tip: “Memory is your code’s private room—Microsoft holds the building keys, but you lock the closet.”
⚠ Common exam trap
It's easy for candidates to assume PaaS means Microsoft handles all security, but the shared responsibility model clearly delineates that data security at the application layer—including in-memory encryption—remains the customer's obligation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The company, because it is responsible for securing its own application data and code.
In the shared responsibility model for PaaS like Azure App Service, Microsoft secures the physical host, OS, and platform runtime, but the customer retains responsibility for securing application-level data, including data in memory. Encrypting data in memory requires application code changes (e.g., using .NET's `ProtectedMemory` or Windows DPAPI), which is solely the customer's responsibility because Microsoft cannot access or manage the application's runtime memory contents.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Azure, because it provides the hosting infrastructure and manages the runtime environment.
Why it's wrong here
Microsoft Azure is responsible for the security of the underlying infrastructure, such as the physical hosts and network. However, data in memory is part of the application data plane, which is the customer's responsibility even in a PaaS environment. Azure does not control or encrypt application-level data in memory.
When this WOULD be correct
This option would be correct if the question asked about encryption of data at rest on Azure-managed storage (e.g., Azure SQL Database) or encryption of data in transit between Azure data centers, where Microsoft provides and manages the encryption.
- ✓
The company, because it is responsible for securing its own application data and code.
Why this is correct
Under the shared responsibility model, the customer always retains responsibility for the security of their data and applications, including data in memory. In a PaaS model, the customer manages the application and data, while the provider manages the underlying platform. Therefore, the company must implement encryption of data in memory within the application.
- ✗
Both Microsoft and the company share this responsibility equally.
Why it's wrong here
While responsibilities are shared, data security (including data in memory) is exclusively the customer's domain. Microsoft does not access or control application memory. The customer is solely responsible for implementing encryption of data in memory. There is no shared responsibility for this specific task.
When this WOULD be correct
This option would be correct if the question asked about responsibility for encrypting data at rest in the underlying storage infrastructure, such as Azure SQL Database's transparent data encryption, where Microsoft manages the encryption keys by default.
- ✗
A third-party encryption service that is automatically enabled for all Azure App Service deployments.
Why it's wrong here
Azure does not automatically enable encryption of data in memory for App Service. The customer must use their own encryption libraries or third-party solutions within the application code. No automatic service covers this requirement.
When this WOULD be correct
This option would be correct if the question asked about a service like Azure SQL Database Transparent Data Encryption (TDE) or Azure Storage Service Encryption, where Microsoft automatically enables encryption at rest by default, and the customer does not need to configure it separately.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓The company, because it is responsible for securing its own application data and code.Correct answer▾
Why this is correct
Under the shared responsibility model, the customer always retains responsibility for the security of their data and applications, including data in memory. In a PaaS model, the customer manages the application and data, while the provider manages the underlying platform. Therefore, the company must implement encryption of data in memory within the application.
✗Microsoft Azure, because it provides the hosting infrastructure and manages the runtime environment.Wrong answer — click to see why▾
Why this is wrong here
In a PaaS model like Azure App Service, Microsoft manages the infrastructure and runtime, but the customer remains responsible for securing application-level data, including data in memory. Encryption of data in memory is an application-layer control, not an infrastructure responsibility.
★ When this WOULD be the correct answer
This option would be correct if the question asked about encryption of data at rest on Azure-managed storage (e.g., Azure SQL Database) or encryption of data in transit between Azure data centers, where Microsoft provides and manages the encryption.
Why candidates choose this
Candidates may mistakenly believe that because Microsoft manages the runtime in PaaS, it also handles all security controls, including application-level encryption. They overlook the shared responsibility model's distinction between 'security of the cloud' and 'security in the cloud'.
✗Both Microsoft and the company share this responsibility equally.Wrong answer — click to see why▾
Why this is wrong here
In a PaaS model like Azure App Service, the customer is responsible for application-level security, including encrypting data in memory. Microsoft secures the infrastructure but does not manage in-memory encryption of customer data.
★ When this WOULD be the correct answer
This option would be correct if the question asked about responsibility for encrypting data at rest in the underlying storage infrastructure, such as Azure SQL Database's transparent data encryption, where Microsoft manages the encryption keys by default.
Why candidates choose this
Candidates may mistakenly believe that PaaS implies full vendor management of all security aspects, overlooking the shared responsibility model's clear division where the customer retains control over application data and code.
✗A third-party encryption service that is automatically enabled for all Azure App Service deployments.Wrong answer — click to see why▾
Why this is wrong here
In Azure App Service (PaaS), Microsoft manages the infrastructure and runtime, but the customer is responsible for application-level security, including in-memory data encryption. There is no automatically enabled third-party encryption service for in-memory data in App Service.
★ When this WOULD be the correct answer
This option would be correct if the question asked about a service like Azure SQL Database Transparent Data Encryption (TDE) or Azure Storage Service Encryption, where Microsoft automatically enables encryption at rest by default, and the customer does not need to configure it separately.
Why candidates choose this
Candidates may assume that Azure automatically handles all encryption, including in-memory, because of the 'platform as a service' abstraction, or they may confuse in-memory encryption with other automatic encryption features like TLS or storage encryption.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
The Shared Responsibility Model
Key term
Azure App Service
Azure App Service is a fully managed platform for building, deploying, and scaling web applications and APIs without managing the underlying infrastructure.
Key term
Shared responsibility model
The shared responsibility model is a framework that defines which security and compliance tasks are handled by the cloud provider and which are handled by the customer.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company migrates its web application to Azure App Service (PaaS) and its data to Azure SQL Database (PaaS). The company wants to understand which security responsibilities it retains after the migration. According to the shared responsibility model, which of the following responsibilities remains the responsibility of the company (customer) when using these PaaS services?
medium- A.Patching the operating system of the web server
- B.Managing network security groups for the virtual network
- ✓ C.Managing user access to the application and database
- D.Physical security of the Azure data center
Why C: In the shared responsibility model for PaaS, the cloud provider manages the underlying infrastructure, including the OS and network security groups, while the customer retains responsibility for managing access to their application and data. For Azure App Service and Azure SQL Database, this means the customer must configure authentication, authorization, and user permissions (e.g., using Azure Active Directory or SQL logins) to control who can access the application and database.
Variation 2. A company is migrating a web application to Azure. The web tier will run on Azure App Service (PaaS) and the database tier will use Azure SQL Database (PaaS). The company's IT team wants to understand their patching responsibilities for the underlying operating system (OS) of each service. According to the shared responsibility model, which statement is correct?
medium- A.The customer is responsible for patching the operating system of both Azure App Service and Azure SQL Database.
- B.Microsoft is responsible for patching the operating system of Azure App Service, and the customer is responsible for patching the operating system of Azure SQL Database.
- C.The customer is responsible for patching the operating system of Azure App Service, and Microsoft is responsible for patching the operating system of Azure SQL Database.
- ✓ D.Microsoft is responsible for patching the operating system of both Azure App Service and Azure SQL Database.
Why D: In the shared responsibility model, Microsoft manages the underlying infrastructure for Platform as a Service (PaaS) services. Both Azure App Service and Azure SQL Database are PaaS offerings, meaning Microsoft handles OS patching, updates, and security for the host OS. The customer is responsible only for their application code and data, not the OS. Therefore, option D is correct.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.