AZ-900 Describe cloud concepts Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Cloud is inherently insecure because data is shared with other customers

  Why it's wrong here

  The premise that multi-tenant cloud environments are inherently insecure is false because cloud providers enforce strict isolation between tenants using hypervisor-level separation, virtual networks, and hardware-backed isolation technologies. Data belonging to different customers is never directly accessible across tenants, and encryption protects data both at rest and in transit. The shared responsibility model means the provider secures the infrastructure and physical hosts, while customers manage their own access controls, so insecurity arises from misconfiguration, not from sharing physical hardware.

• ✓

  Cloud providers invest in extensive security teams and technologies that most organizations can't match

  Why this is correct

  Cloud providers invest enormous resources in security that individual organizations typically cannot replicate on their own, including 24/7 security operations centers, global threat intelligence feeds, advanced machine learning-based anomaly detection, automated vulnerability scanning, and distributed denial-of-service (DDoS) mitigation. Azure, for example, spends billions annually on cybersecurity and employs thousands of security engineers who monitor attack patterns worldwide to harden the platform continuously. These capabilities give customers access to enterprise-grade security controls, such as privileged identity management, just-in-time access, and encryption key management, that would be prohibitively expensive to build and staff in a private data center, which is a major security benefit of cloud adoption.

• ✗

  Moving to cloud automatically makes you compliant with all regulations

  Why it's wrong here

  Moving to the cloud does not automatically make an organization compliant with every regulation because compliance obligations follow the data and the workloads, not the infrastructure location simply because it is cloud-based. In the shared responsibility model, cloud providers offer compliance certifications and attestations (like ISO 27001, SOC 2, and FedRAMP) for the platform, but customers remain responsible for meeting regulatory requirements in their own use of the service such as data classification, access governance, data residency, and encryption configurations. Regulations like GDPR also place direct accountability on the data controller, which is usually the customer, irrespective of whether data is hosted on-premises or in Azure.

• ✗

  Cloud security means you never need to patch your applications

  Why it's wrong here

  Choosing the cloud does not eliminate all patching responsibilities because patching obligations depend on the service model and the shared responsibility model. In IaaS scenarios, the customer is fully responsible for patching the operating system and installed applications on their virtual machines, while Azure only patches the underlying hypervisor and physical hardware. Even in PaaS and SaaS models, although the provider patches the platform and infrastructure, customers may still need to update their application code, configurations, and custom components, and they remain responsible for applying security patches to anything they deploy on the service.

Go deeper

Related to this question