AZ-900 Describe cloud concepts Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  In all three models, Microsoft is responsible for securing the physical datacenter and network infrastructure. For IaaS, the customer is responsible for the guest OS and applications; for PaaS, the customer is responsible for the application code and data; for SaaS, the customer is responsible for data and user accounts.

  Why this is correct

  This is accurate: the shared responsibility model always assigns physical security of datacenters, including networking hardware, to Microsoft across IaaS, PaaS, and SaaS. In IaaS, the customer manages the guest operating system and all installed applications, along with associated patches and configuration. In PaaS, Microsoft handles the underlying platform and runtime, yet the customer retains responsibility for the application code and its data. In SaaS, Microsoft operates the entire service, so the customer's duties narrow to managing their data, user identities, and access controls.

• ✗

  In IaaS, Microsoft is responsible for the guest OS; in PaaS, Microsoft is responsible for the application code; in SaaS, the customer is responsible only for data.

  Why it's wrong here

  This is incorrect because in IaaS the customer is responsible for the guest OS, not Microsoft. In PaaS, the customer is responsible for the application code. In SaaS, the customer is responsible for data and user access, not just data.

• ✗

  In IaaS, the customer is responsible for everything from the physical infrastructure up; in PaaS, Microsoft is responsible for the application runtime and the customer is responsible only for data; in SaaS, Microsoft is responsible for everything.

  Why it's wrong here

  This is incorrect because in IaaS, Microsoft is responsible for the physical infrastructure (datacenter, networking, servers). In PaaS, the customer is also responsible for application code and data, not just data. In SaaS, the customer is responsible for data and user access, not nothing.

  When this WOULD be correct

  This option would be correct if the question asked about a scenario where the customer manages their own physical servers on-premises (not cloud), or if the question specified a 'bare metal' IaaS where the customer controls the entire stack including the physical server. It could also apply if the question focused on a PaaS where the provider manages the runtime but the customer only provides data (e.g., a fully managed database service).

• ✗

  In all three models, the customer is responsible for securing all application code and data, while Microsoft secures the underlying hardware and operating system.

  Why it's wrong here

  This is incorrect because the division of responsibility varies by model. For IaaS, the customer secures the OS; for SaaS, Microsoft secures the underlying OS and application; the customer does not have full responsibility for application code in all models.

  When this WOULD be correct

  This option would be correct if the question specified that the customer manages the entire OS layer (e.g., customer-managed VMs in IaaS) and Microsoft only secures the physical hardware, ignoring PaaS and SaaS distinctions.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question