AZ-900 Describe cloud concepts Practice Question
A company migrates its web application to Azure App Service (PaaS) and its data to Azure SQL Database (PaaS). The company wants to understand which security responsibilities it retains after the migration. According to the shared responsibility model, which of the following responsibilities remains the responsibility of the company (customer) when using these PaaS services?
⚠ Common exam trap
It's easy for candidates to confuse PaaS with IaaS, assuming they must manage OS patching or network security groups, when in fact PaaS shifts those responsibilities to the provider, leaving user access management as the key retained duty.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Managing user access to the application and database
In the shared responsibility model for PaaS, the cloud provider manages the underlying infrastructure, including the OS and network security groups, while the customer retains responsibility for managing access to their application and data. For Azure App Service and Azure SQL Database, this means the customer must configure authentication, authorization, and user permissions (e.g., using Azure Active Directory or SQL logins) to control who can access the application and database.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Patching the operating system of the web server
Why it's wrong here
In Azure App Service, which is a fully managed PaaS offering, Microsoft handles all operating system patching, including security updates and bug fixes, for the virtual machines that host the web application. The customer is not allowed to log into the OS or install patches, because such access is abstracted away by the platform. The customer's only patching responsibility is for the application code, binaries, and any third-party libraries they deploy to the service. This contrasts sharply with IaaS VMs, where the customer must manage OS updates and security configurations.
When this WOULD be correct
If the question were about an IaaS virtual machine (e.g., Azure VM), where the customer manages the guest OS, then patching the operating system would be the customer's responsibility.
- ✗
Managing network security groups for the virtual network
Why it's wrong here
In PaaS, the provider manages the network infrastructure. While customers can configure some network controls (e.g., access restrictions), the underlying network security groups are managed by Azure for the platform. The customer is responsible for configuring inbound/outbound access rules at the application level, but not the virtual network NSGs unless they integrate their own VNet.
When this WOULD be correct
If the question involved IaaS services (e.g., Azure VMs) where customers are responsible for managing NSGs to control inbound/outbound traffic to their virtual network, then managing NSGs would be a customer responsibility.
- ✓
Managing user access to the application and database
Why this is correct
Managing user access to the application and database is always the customer's responsibility, even in PaaS. Authentication and authorization for both the application layer (e.g., via Azure AD or app roles) and the data layer (e.g., database logins, row-level security) remain entirely under the customer's control. Azure App Service provides features like Managed Identity to help simplify access, but the customer must still configure and enforce who can call the app and who can read or modify data. This is a fundamental part of the shared responsibility model that does not shift with PaaS.
- ✗
Physical security of the Azure data center
Why it's wrong here
Physical security of the Azure data center, including perimeters, guards, biometric access controls, and environmental safeguards, is exclusively the cloud provider's responsibility. Because the customer never receives physical or logical access to the underlying servers hosting a PaaS service like Azure App Service, there is nothing the customer can do to secure the facility itself. The provider is also responsible for compliance certifications related to physical safeguards, such as SOC 1/2 and ISO 27001. This is a clear example of 'security of the cloud' as opposed to 'security in the cloud.'
When this WOULD be correct
This option would be correct in a question about IaaS, where the customer is responsible for physical security of their own on-premises data centers, or in a question asking which responsibility belongs to Microsoft.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Managing user access to the application and databaseCorrect answer▾
Why this is correct
Managing user access to the application and database is always the customer's responsibility, even in PaaS. Authentication and authorization for both the application layer (e.g., via Azure AD or app roles) and the data layer (e.g., database logins, row-level security) remain entirely under the customer's control. Azure App Service provides features like Managed Identity to help simplify access, but the customer must still configure and enforce who can call the app and who can read or modify data. This is a fundamental part of the shared responsibility model that does not shift with PaaS.
✗Patching the operating system of the web serverWrong answer — click to see why▾
Why this is wrong here
In Azure App Service (PaaS), Microsoft manages the underlying operating system, including patching. The customer does not have access to the OS and is not responsible for patching it.
★ When this WOULD be the correct answer
If the question were about an IaaS virtual machine (e.g., Azure VM), where the customer manages the guest OS, then patching the operating system would be the customer's responsibility.
Why candidates choose this
Candidates often confuse PaaS with IaaS, assuming that patching the OS is always a customer responsibility, or they overlook that PaaS abstracts the OS management.
✗Managing network security groups for the virtual networkWrong answer — click to see why▾
Why this is wrong here
In Azure PaaS services like App Service and SQL Database, network security groups (NSGs) are managed by Azure at the platform level; customers do not manage NSGs for the underlying virtual network infrastructure.
★ When this WOULD be the correct answer
If the question involved IaaS services (e.g., Azure VMs) where customers are responsible for managing NSGs to control inbound/outbound traffic to their virtual network, then managing NSGs would be a customer responsibility.
Why candidates choose this
Candidates may confuse PaaS with IaaS, assuming that network security management always falls to the customer, or they may overestimate the customer's control over network components in PaaS environments.
✗Physical security of the Azure data centerWrong answer — click to see why▾
Why this is wrong here
Physical security of Azure data centers is always Microsoft's responsibility under the shared responsibility model, regardless of the service model (IaaS, PaaS, or SaaS).
★ When this WOULD be the correct answer
This option would be correct in a question about IaaS, where the customer is responsible for physical security of their own on-premises data centers, or in a question asking which responsibility belongs to Microsoft.
Why candidates choose this
Candidates may confuse the shared responsibility model and think that because they are using a cloud service, they are responsible for all security aspects, including physical security of the data center.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
What is Cloud Computing?
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Azure App Service
Azure App Service is a fully managed platform for building, deploying, and scaling web applications and APIs without managing the underlying infrastructure.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.