Shared Responsibility Model in Cloud Computing
What is the shared responsibility model in cloud computing?
Quick Answer
The answer is a framework dividing security responsibilities between the cloud provider and the customer. This model is correct because it clarifies that the provider secures the infrastructure *of* the cloud—physical hosts, network, and hypervisor—while the customer secures everything *in* the cloud, such as data, identities, and OS configurations. On the Microsoft Azure Fundamentals AZ-900 exam, this concept tests your understanding that security is always a shared obligation, never fully transferred, and it frequently appears in scenario-based questions asking who is responsible for a specific task. A common trap is assuming the provider handles everything in Platform as a Service (PaaS) or Software as a Service (SaaS), but the customer always retains responsibility for their own data and access. Remember the mnemonic: “Provider protects the floor, customer locks the door.”
⚠ Common exam trap
Watch out — candidates often assume the provider handles all security (especially in PaaS/SaaS), forgetting that the customer always retains responsibility for data, identities, and access management regardless of the service model.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A framework dividing security responsibilities between the cloud provider and the customer
The shared responsibility model defines the division of security and compliance obligations between the cloud provider and the customer. The provider is responsible for the security 'of' the cloud (physical hosts, network, hypervisor), while the customer is responsible for security 'in' the cloud (data, access management, OS configuration). This division varies by service model (IaaS, PaaS, SaaS), but the core principle is that security is a shared, not transferred, responsibility.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The provider and customer each pay half the cost of cloud services
Why it's wrong here
Shared responsibility is about security duties, not cost sharing.
- ✓
A framework dividing security responsibilities between the cloud provider and the customer
Why this is correct
The shared responsibility model defines which security duties the provider handles versus the customer.
- ✗
An agreement where customers share their infrastructure with other cloud users
Why it's wrong here
Resource sharing is multi-tenancy; shared responsibility is about security obligation division.
- ✗
A service where two cloud providers share management of customer workloads
Why it's wrong here
Shared responsibility is between the cloud provider and the customer, not between two providers.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
Learn chapter
What is Cloud Computing?
Key term
Cloud computing
Cloud computing is the on-demand delivery of IT resources over the internet, allowing users to access computing power, storage, and applications without owning physical hardware.
Key term
PaaS
Platform as a Service (PaaS) is a cloud computing model that provides a managed platform for developers to build, run, and manage applications without dealing with the underlying infrastructure.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on AZ-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A hospital stores patient data in the cloud. The hospital is responsible for encrypting the data before uploading, managing user access, and complying with healthcare regulations. The cloud provider is responsible for securing the physical datacenter, network infrastructure, and hypervisor. This model describes which concept?
medium- ✓ A.Shared responsibility model
- B.Infrastructure as a Service (IaaS)
- C.Platform as a Service (PaaS)
- D.Software as a Service (SaaS)
Why A: The scenario explicitly divides security responsibilities between the hospital (data encryption, access management, regulatory compliance) and the cloud provider (physical datacenter, network, hypervisor). This division of security obligations is the core definition of the shared responsibility model, which applies across all cloud service models (IaaS, PaaS, SaaS) but is most clearly illustrated here where the customer retains control over data and identity layers.
Variation 2. A hospital is migrating patient data to the cloud. The hospital is responsible for managing who can access the data and for encrypting the data before upload. The cloud provider is responsible for securing the physical datacenters, network infrastructure, and hypervisor. This division of security responsibilities is described by which model?
medium- ✓ A.Shared responsibility model
- B.Defense in depth
- C.Principle of least privilege
- D.Zero trust model
Why A: The shared responsibility model defines the division of security obligations between the cloud provider and the customer. In this scenario, the hospital (customer) is responsible for identity and access management (IAM) and data encryption at rest and in transit, while the cloud provider secures the physical datacenter, network infrastructure, and hypervisor. This clear separation of duties is the core of the shared responsibility model, which varies by service model (IaaS, PaaS, SaaS).
Variation 3. A hospital stores sensitive patient data in the cloud. They want to ensure that data remains secure and that the cloud provider has implemented strict physical security controls, such as biometric access and 24/7 surveillance at datacenters. Which aspect of the shared responsibility model does this describe?
easy- A.Responsibility of the customer for network security
- ✓ B.Responsibility of the cloud provider for physical security
- C.Responsibility of the customer for data classification
- D.Responsibility of the customer for identity and access management
Why B: The shared responsibility model delineates that the cloud provider is responsible for the security 'of' the cloud, which includes physical infrastructure controls like biometric access and 24/7 surveillance at datacenters. This question specifically asks about physical security controls, which fall under the provider's domain regardless of the deployment model (IaaS, PaaS, or SaaS). Therefore, option B is correct because the provider must secure the physical premises housing the servers and storage.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.