AZ-900 Describe cloud concepts Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The customer manages the application, runtime, and operating system

  Why it's wrong here

  This statement describes the customer's responsibilities in an IaaS model, not SaaS. In IaaS, the customer manages the application, runtime, and operating system, while the provider only supplies the virtualized hardware, network, and physical infrastructure. In SaaS, the provider manages the application, runtime, and OS, so the customer does not install, patch, or run those components; they only interact with the software's features and manage their own data and users.

• ✓

  The provider manages everything; the customer manages only data and user access

  Why this is correct

  In SaaS, the provider manages the entire underlying stack: physical datacenter, network, storage, servers, virtualization, OS, middleware, runtime, and application code. The customer's only responsibilities are data-related governance, such as classifying data, managing identities, controlling user access, and configuring tenant security settings like multi-factor authentication. This is the correct representation of the shared responsibility model at the SaaS end, where the provider's scope is maximized.

• ✗

  The customer and provider share equal responsibility for all components

  Why it's wrong here

  The shared responsibility model is a spectrum based on service type, but it is never a 50/50 split across all components, especially in SaaS. In SaaS, the provider is responsible for the entire physical, network, operating system, middleware, runtime, and application stack, while the customer retains only data classification, account management, and user access. Thus, equal responsibility is factually incorrect because the provider carries ~95% of the responsibilities, and even in IaaS or PaaS the split is asymmetric, never equal.

• ✗

  The customer manages the runtime and middleware

  Why it's wrong here

  This describes the customer's responsibility under PaaS, not SaaS. In PaaS, the provider manages the runtime, middleware, and OS while the customer deploys and configures their application code; however, in SaaS, the provider manages the runtime, middleware, and the application itself. Saying 'the customer manages the runtime and middleware' in a SaaS context confuses the layers of the shared responsibility model with the deployment model being asked about.

Go deeper

Related to this question