AZ-900 Describe cloud concepts Practice Question
A company is migrating a web application to Azure. The web tier will run on Azure App Service (PaaS) and the database tier will use Azure SQL Database (PaaS). The company's IT team wants to understand their patching responsibilities for the underlying operating system (OS) of each service. According to the shared responsibility model, which statement is correct?
⚠ Common exam trap
It's easy for candidates to confuse IaaS responsibilities (where customers patch the OS) with PaaS responsibilities, leading them to incorrectly assign OS patching to the customer for services like Azure App Service or Azure SQL Database.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft is responsible for patching the operating system of both Azure App Service and Azure SQL Database.
In the shared responsibility model, Microsoft manages the underlying infrastructure for Platform as a Service (PaaS) services. Both Azure App Service and Azure SQL Database are PaaS offerings, meaning Microsoft handles OS patching, updates, and security for the host OS. The customer is responsible only for their application code and data, not the OS. Therefore, option D is correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The customer is responsible for patching the operating system of both Azure App Service and Azure SQL Database.
Why it's wrong here
Both Azure App Service and Azure SQL Database are PaaS offerings, meaning the cloud provider—Microsoft—handles OS patching, security updates, and hardware maintenance for the entire service stack. The customer's responsibility is limited to the application code in App Service and to the data and schema in SQL Database; OS-level management is never exposed to you for either service. Therefore, assigning OS patching to the customer for both products misstates the shared responsibility model.
When this WOULD be correct
This option would be correct if the question specified IaaS services, such as Azure Virtual Machines, where the customer is responsible for OS patching for both the web and database tiers.
- ✗
Microsoft is responsible for patching the operating system of Azure App Service, and the customer is responsible for patching the operating system of Azure SQL Database.
Why it's wrong here
Azure SQL Database is a fully managed relational database service in which Microsoft not only patches the OS on the cluster but also updates the SQL Server database engine itself. Customers do not receive OS-level access to the server; you can only connect as a database user. Thus, the claim that a customer must patch the SQL Database OS is false—the physical and virtual OS layers are handled entirely by Microsoft.
When this WOULD be correct
If the question involved a hybrid scenario where the customer manages a virtual machine (IaaS) for the web tier and uses Azure SQL Database (PaaS) for the database tier, then the customer would be responsible for patching the OS of the VM, while Microsoft patches the OS of Azure SQL Database.
- ✗
The customer is responsible for patching the operating system of Azure App Service, and Microsoft is responsible for patching the operating system of Azure SQL Database.
Why it's wrong here
Azure App Service is a fully managed Platform-as-a-Service (PaaS) compute service; Microsoft owns and patches the operating system of the underlying virtual machines that host your web app. You never have direct access to that OS, so the premise that the customer patching the App Service OS is incorrect. Only the application code and application-level configuration fall under your responsibility, not the base OS.
When this WOULD be correct
This option would be correct if the question specified that the web tier runs on Azure Virtual Machines (IaaS) instead of App Service, and the database tier uses SQL Server on a VM (IaaS). In that case, the customer patches the OS for the web VM, while Microsoft patches the OS for the managed SQL Database.
- ✓
Microsoft is responsible for patching the operating system of both Azure App Service and Azure SQL Database.
Why this is correct
This is correct. Both Azure App Service and Azure SQL Database are Platform as a Service (PaaS) offerings. In PaaS, Microsoft handles the underlying infrastructure, including OS patching, security updates, and hardware maintenance. The customer focuses on managing their application and data.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Microsoft is responsible for patching the operating system of both Azure App Service and Azure SQL Database.Correct answer▾
Why this is correct
This is correct. Both Azure App Service and Azure SQL Database are Platform as a Service (PaaS) offerings. In PaaS, Microsoft handles the underlying infrastructure, including OS patching, security updates, and hardware maintenance. The customer focuses on managing their application and data.
✗The customer is responsible for patching the operating system of both Azure App Service and Azure SQL Database.Wrong answer — click to see why▾
Why this is wrong here
In the shared responsibility model, Microsoft manages the underlying OS for PaaS services like Azure App Service and Azure SQL Database. The customer is responsible only for application-level patching, not OS patching.
★ When this WOULD be the correct answer
This option would be correct if the question specified IaaS services, such as Azure Virtual Machines, where the customer is responsible for OS patching for both the web and database tiers.
Why candidates choose this
Candidates may mistakenly believe that PaaS requires customer OS management, confusing it with IaaS responsibilities, or they may think the database tier requires more customer control.
✗Microsoft is responsible for patching the operating system of Azure App Service, and the customer is responsible for patching the operating system of Azure SQL Database.Wrong answer — click to see why▾
Why this is wrong here
Both Azure App Service and Azure SQL Database are PaaS services, so Microsoft manages and patches the underlying OS. Option B incorrectly assigns OS patching for Azure SQL Database to the customer.
★ When this WOULD be the correct answer
If the question involved a hybrid scenario where the customer manages a virtual machine (IaaS) for the web tier and uses Azure SQL Database (PaaS) for the database tier, then the customer would be responsible for patching the OS of the VM, while Microsoft patches the OS of Azure SQL Database.
Why candidates choose this
Candidates may mistakenly think that because Azure SQL Database is a database service, the customer is responsible for OS patching, or they may confuse the shared responsibility model for PaaS vs IaaS services.
✗The customer is responsible for patching the operating system of Azure App Service, and Microsoft is responsible for patching the operating system of Azure SQL Database.Wrong answer — click to see why▾
Why this is wrong here
In the shared responsibility model, Microsoft manages the underlying OS for both Azure App Service (PaaS) and Azure SQL Database (PaaS). The customer is only responsible for patching the application and database code, not the OS.
★ When this WOULD be the correct answer
This option would be correct if the question specified that the web tier runs on Azure Virtual Machines (IaaS) instead of App Service, and the database tier uses SQL Server on a VM (IaaS). In that case, the customer patches the OS for the web VM, while Microsoft patches the OS for the managed SQL Database.
Why candidates choose this
Candidates may mistakenly think that because the web application is customer-managed code, the customer also patches the OS for App Service, or they confuse PaaS with IaaS responsibilities.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
The Shared Responsibility Model
Key term
Shared responsibility model
The shared responsibility model is a framework that defines which security and compliance tasks are handled by the cloud provider and which are handled by the customer.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.