AZ-900 Describe cloud concepts Practice Question
A company runs its production database on an Azure SQL Database (PaaS) and its custom application on an Azure virtual machine (IaaS). The company needs to ensure that operating system security patches are applied. According to the shared responsibility model, which resource requires the company to apply OS patches?
⚠ Common exam trap
The trap here is that candidates mistakenly assume PaaS services like Azure SQL Database still require customer OS patching, confusing the boundary between customer-managed and provider-managed responsibilities under the shared responsibility model.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure virtual machine only
In the shared responsibility model, the customer is responsible for securing the operating system on IaaS resources like Azure virtual machines. Azure SQL Database is a PaaS service where Microsoft manages the underlying OS, including patch management. Therefore, only the Azure virtual machine requires the company to apply OS security patches.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure SQL Database only
Why it's wrong here
Azure SQL Database is a fully managed PaaS service, meaning Microsoft handles the underlying OS and infrastructure, including security patching and updates. The company does not have access to the OS and is not responsible for patching it. Moreover, the Azure virtual machine does require the company to patch the guest OS, so the correct answer is the opposite of this option — the virtual machine only.
When this WOULD be correct
In a question asking which resource requires the customer to manage the database software (e.g., applying SQL Server updates) rather than OS patches, Azure SQL Database would be correct if the scenario involved a customer-managed database on a VM.
- ✓
Azure virtual machine only
Why this is correct
An Azure virtual machine is an IaaS (Infrastructure-as-a-Service) workload. Under the shared responsibility model, Microsoft manages the physical hosts and hypervisor, but the customer is fully responsible for the guest operating system — including security patches, updates, and OS-level configuration. Because this is the only resource listed where the company must perform OS patching, this is the correct answer.
- ✗
Both Azure SQL Database and the virtual machine
Why it's wrong here
This is incorrect because Azure SQL Database is a PaaS (Platform-as-a-Service) offering where Microsoft manages the underlying operating system, including all OS patches and updates. The company's responsibility for Azure SQL Database is limited to database-level tasks such as schema design, user access, and data management — not OS patching. Therefore, only the Azure virtual machine requires the company to apply OS patches, not both resources.
When this WOULD be correct
This option would be correct if the question asked about applying security patches to the database software itself (not the OS) on Azure SQL Database, and also to the OS on the VM. For example: 'A company uses Azure SQL Database and an Azure VM. For which resources is the company responsible for applying security patches to the database software and the OS?'
- ✗
Neither resource requires the company to apply OS patches
Why it's wrong here
This statement is false because an Azure virtual machine is an IaaS service and the customer explicitly owns the patching and maintenance of the guest OS. In contrast, Azure SQL Database is a PaaS service where Microsoft handles OS-level patching as part of the platform's automated maintenance. Since the VM does require company-applied OS patches, claiming that neither does is incorrect.
When this WOULD be correct
Option D would be correct if the question asked about a fully managed PaaS service like Azure App Service or Azure SQL Database, where the cloud provider handles all OS patching, and the customer has no responsibility for OS-level updates.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure virtual machine onlyCorrect answer▾
Why this is correct
An Azure virtual machine is an IaaS (Infrastructure-as-a-Service) workload. Under the shared responsibility model, Microsoft manages the physical hosts and hypervisor, but the customer is fully responsible for the guest operating system — including security patches, updates, and OS-level configuration. Because this is the only resource listed where the company must perform OS patching, this is the correct answer.
✗Azure SQL Database onlyWrong answer — click to see why▾
Why this is wrong here
Azure SQL Database is a PaaS service where Microsoft manages the underlying OS, including security patches. The customer is only responsible for data and access management, not OS patching.
★ When this WOULD be the correct answer
In a question asking which resource requires the customer to manage the database software (e.g., applying SQL Server updates) rather than OS patches, Azure SQL Database would be correct if the scenario involved a customer-managed database on a VM.
Why candidates choose this
Candidates may mistakenly think that because Azure SQL Database is a managed service, the customer still handles some patching, or they confuse OS patching with database-level patching.
✗Both Azure SQL Database and the virtual machineWrong answer — click to see why▾
Why this is wrong here
In the shared responsibility model, Azure manages OS patches for PaaS services like Azure SQL Database, while the customer is responsible for patching the OS on IaaS VMs. Option C is wrong because it incorrectly states that both resources require the company to apply OS patches.
★ When this WOULD be the correct answer
This option would be correct if the question asked about applying security patches to the database software itself (not the OS) on Azure SQL Database, and also to the OS on the VM. For example: 'A company uses Azure SQL Database and an Azure VM. For which resources is the company responsible for applying security patches to the database software and the OS?'
Why candidates choose this
Candidates may mistakenly think that because both resources are in Azure, the company must patch both, or they may not clearly distinguish between PaaS and IaaS responsibilities under the shared responsibility model.
✗Neither resource requires the company to apply OS patchesWrong answer — click to see why▾
Why this is wrong here
In the shared responsibility model, Microsoft manages OS patches for PaaS services like Azure SQL Database, but for IaaS virtual machines, the customer is responsible for applying OS patches. Therefore, the company must apply patches to the VM, making option D incorrect.
★ When this WOULD be the correct answer
Option D would be correct if the question asked about a fully managed PaaS service like Azure App Service or Azure SQL Database, where the cloud provider handles all OS patching, and the customer has no responsibility for OS-level updates.
Why candidates choose this
Candidates may mistakenly believe that Azure handles all security patches for all services, overlooking the distinction between PaaS and IaaS responsibilities.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
Learn chapter
The Shared Responsibility Model
Key term
Shared responsibility
Shared responsibility is a cloud security model where the cloud provider and the customer each own distinct parts of security and compliance duties.
Key term
Azure SQL Database
Azure SQL Database is a fully managed relational database-as-a-service (DBaaS) in Microsoft Azure, based on the SQL Server engine, that handles scaling, backups, patching, and high availability automatically.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.