AZ-900 Describe cloud concepts Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Microsoft is responsible for all security.

  Why it's wrong here

  Microsoft is not responsible for all security because in an IaaS environment the customer manages the guest OS, runtime, middleware, and applications, which are outside Microsoft's control. While Microsoft secures the physical host, hypervisor, and network, the customer must apply OS patches, configure firewalls, and protect application-level credentials. Even in PaaS and SaaS, the customer remains responsible for their data, access policies, and identity configurations, so security is never solely the provider's obligation.

  When this WOULD be correct

  For a fully managed PaaS service like Azure SQL Database, Microsoft is responsible for securing the underlying OS and platform, while the customer manages data and access. A question asking about PaaS security would make this correct.

• ✗

  The customer is responsible for all security.

  Why it's wrong here

  This is incorrect because Microsoft retains physical and environmental security, including the datacenter facilities, power, cooling, and network infrastructure, even in an IaaS model. However, the customer is still responsible for the guest OS, applications, and data they install and configure, so the customer does not own every security control; their responsibilities begin where Microsoft's infrastructure responsibilities end.

  When this WOULD be correct

  This option would be correct if the question specified a scenario where the customer uses an on-premises server or a fully customer-managed environment, such as a physical server in their own data center, where the customer is responsible for all security layers.

• ✓

  Microsoft is responsible for the physical host and network, while the customer is responsible for the guest OS and applications.

  Why this is correct

  In an IaaS deployment, Microsoft protects the physical datacenter, server hardware, the hypervisor layer, and the physical network, while the customer must secure the guest OS, including patching, hardening, and configuration, along with its applications and data. This distinction precisely defines the shared responsibility model: the cloud provider manages the infrastructure up to the virtualization layer, and the customer manages everything deployed on top of it.

• ✗

  Responsibility is split 50/50.

  Why it's wrong here

  The shared responsibility model is not a literal 50/50 split based on percentage of effort or controls; it is a layered division based on the service model. For IaaS, customers handle the majority of security controls—guest OS, apps, data—while Microsoft handles the underlying hardware and network, so the split is uneven and varies by workload. In PaaS or SaaS, the balance shifts significantly toward Microsoft, further disproving any fixed 50/50 division.

  When this WOULD be correct

  In a scenario where a question asks about a shared responsibility model for a service like Azure SQL Database (PaaS), where Microsoft manages the OS and platform, and the customer manages data and access, the responsibility might be described as roughly 50/50 in terms of management effort, though not an exact split.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question