Question 214 of 981
AZ-900 Describe cloud concepts Practice Question
In the shared responsibility model for cloud computing, which responsibility always remains with the customer regardless of the cloud service type?
⚠ Common exam trap
Candidates often confuse 'patching the OS' (which shifts to the provider in PaaS/SaaS) with 'managing data and access identities' (which is always the customer's responsibility), leading them to incorrectly select Option D as the answer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Managing data and access identities
Under the shared responsibility model, the customer is always responsible for managing data and access identities, regardless of whether the service is IaaS, PaaS, or SaaS. This includes classifying data, encrypting data at rest and in transit, and configuring identity and access management (IAM) policies. Even in SaaS, where the provider manages the application, the customer must control who has access and how data is protected.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Managing physical network infrastructure
Why it's wrong here
Physical network infrastructure—including routers, switches, cables, and underlay networks in the datacenter—is exclusively managed and secured by the cloud provider across all service models. Customers have no access or management rights to this hardware, so it is never part of the customer's work. Thus it cannot always be a customer responsibility.
- ✗
Patching the underlying hypervisor
Why it's wrong here
The hypervisor is the virtualization layer that separates guest operating systems from physical hardware, and the provider applies all patches to it regardless of whether you are using IaaS, PaaS, or SaaS. Customers interact only with the virtualized resources, never with the hypervisor itself, so patching it is outside the customer's management domain. This makes it an incorrect example of a customer-controlled task.
- ✓
Managing data and access identities
Why this is correct
Regardless of the service model, you always manage the security, classification, and lifecycle of your own data, along with controlling who can access it through identities, credentials, and permissions. Even in SaaS, while the provider secures the application and platform, you decide which users get which roles, and you are accountable for compliance of that data. This makes data management and identity/access the core responsibility that never transfers to the provider.
- ✗
Maintaining operating system patches
Why it's wrong here
In IaaS, you are responsible for patching the operating system on your virtual machines; however, in PaaS and SaaS, the cloud provider typically applies these patching duties. Because the responsibility shifts depending on the service model, OS patching cannot be classified as always the customer's obligation. This is why it is not the correct choice.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.