AZ-900 Describe cloud concepts Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Both the cloud provider and customer share responsibility for physical security

  Why it's wrong here

  This option incorrectly suggests that physical security is part of the shared responsibility model's split between provider and customer. In actuality, physical security controls—such as building perimeter defenses, server room access, surveillance, and hardware disposition—are exclusively managed by the cloud provider, and customers are never granted physical access to the infrastructure. The customer's shared duties begin at the virtualization layer (for IaaS) or higher, never extending down to the datacenter's physical environment.

• ✓

  Physical security is entirely the cloud provider's responsibility

  Why this is correct

  Across every cloud service model—IaaS, PaaS, and SaaS—the cloud provider is solely responsible for physical security of the data center. This includes protecting the facilities with biometric access controls, multi-factor authentication for entry, continuous video monitoring, and physically securing server racks and hardware. Customers interact only with logical resources through the cloud interface, never with the physical hardware or facilities, so responsibility for physical security cannot be transferred or shared.

• ✗

  Customers are responsible for physical security when using IaaS

  Why it's wrong here

  While IaaS customers are responsible for securing the operating system, applications, and network configurations they deploy, this does not extend to the physical data center or hardware. The provider retains custody and control of the physical server farm—including maintenance, power, cooling, and physical access controls—even when a customer manages a virtual machine down to the OS level. Therefore, IaaS customers must secure the guest OS and application layer, but physical security remains a provider-side function that the customer cannot alter or assume.

• ✗

  Physical security responsibility depends on the customer's support plan level

  Why it's wrong here

  Support plans, like Basic, Developer, Standard, or Premier, determine the level of technical support, response times, and operational guidance a customer receives, but they have zero impact on security responsibility allocation. Physical security of cloud data centers is a provider-controlled obligation that remains constant under any support tier or contract agreement. Choosing a higher support plan yields better support services and service-level response guarantees, but it does not grant customers any physical access or obligation to manage provider facilities.