AZ-900 Describe cloud concepts Practice Question
A company plans to migrate a line-of-business application to Azure virtual machines (IaaS). The company's security team is reviewing the shared responsibility model to determine which security tasks are handled by Microsoft. Which of the following security responsibilities belongs to Microsoft?
⚠ Common exam trap
It's easy for candidates to confuse Microsoft's responsibility for the physical infrastructure with customer-managed tasks like OS patching or firewall rules, leading them to incorrectly select options A or B.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Maintaining physical security of the datacenter where the servers are hosted
Under the shared responsibility model for IaaS, Microsoft is responsible for the physical security of its datacenters, including access controls, surveillance, and environmental safeguards. This is a foundational layer that customers cannot manage, making option C correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configuring operating system firewalls on the virtual machines
Why it's wrong here
Configuring the guest operating system firewall is a customer-owned task because the customer deploys and manages the VM's OS. Microsoft supplies the underlying hypervisor and platform-level networking, such as Azure Network Security Groups, but it does not alter settings inside the guest OS. In an IaaS environment, the customer is responsible for all operating system configuration, including firewall rules, users, and security policies, because Microsoft only has control up to the virtualization boundary.
When this WOULD be correct
If the question asked about a PaaS service like Azure App Service, where Microsoft manages the underlying OS and firewall rules, then configuring OS firewalls would be Microsoft's responsibility.
- ✗
Patching the guest operating system of the virtual machines
Why it's wrong here
Patching the guest operating system of an Azure VM is exclusively the customer's responsibility. Microsoft patches the host OS, hypervisor, and physical components, but the guest OS image is managed by the customer after deployment. To maintain compliance and security, the customer must use tools like Azure Update Management, Azure Automation, or manual patching processes. Failure to patch guest OS leaves the workload vulnerable, and the responsibility for that failure rests with the customer.
When this WOULD be correct
This would be correct if the question asked about responsibilities for a PaaS service like Azure App Service, where Microsoft manages the underlying OS and patches it automatically.
- ✓
Maintaining physical security of the datacenter where the servers are hosted
Why this is correct
Under the Azure shared responsibility model, Microsoft retains absolute accountability for the physical infrastructure of its datacenters. This includes biometric access controls, video surveillance, intrusion detection, and environmental safeguards such as fire suppression and temperature regulation. No matter the customer's workload type (IaaS, PaaS, or SaaS), the cloud provider exclusively manages physical security, and the customer has no access or control over these physical layers.
- ✗
Managing application-level user authentication and authorization
Why it's wrong here
This is incorrect. Application-level authentication and authorization are managed by the customer because they own and operate the application. Microsoft provides identity services like Azure AD but the customer must configure and manage access policies.
When this WOULD be correct
This would be correct in a SaaS scenario, where the provider manages the entire application stack, including user authentication. For example, a question about Microsoft 365 would list managing user access as Microsoft's responsibility.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Maintaining physical security of the datacenter where the servers are hostedCorrect answer▾
Why this is correct
Under the Azure shared responsibility model, Microsoft retains absolute accountability for the physical infrastructure of its datacenters. This includes biometric access controls, video surveillance, intrusion detection, and environmental safeguards such as fire suppression and temperature regulation. No matter the customer's workload type (IaaS, PaaS, or SaaS), the cloud provider exclusively manages physical security, and the customer has no access or control over these physical layers.
✗Configuring operating system firewalls on the virtual machinesWrong answer — click to see why▾
Why this is wrong here
In the shared responsibility model for IaaS, Microsoft manages the physical infrastructure, while the customer is responsible for configuring guest OS firewalls. Option A is a customer responsibility.
★ When this WOULD be the correct answer
If the question asked about a PaaS service like Azure App Service, where Microsoft manages the underlying OS and firewall rules, then configuring OS firewalls would be Microsoft's responsibility.
Why candidates choose this
Candidates may confuse IaaS with PaaS or think that Microsoft handles all security configurations in the cloud, overlooking the customer's role in managing the guest OS.
✗Patching the guest operating system of the virtual machinesWrong answer — click to see why▾
Why this is wrong here
In the shared responsibility model for IaaS, Microsoft is responsible for the physical infrastructure, while the customer is responsible for patching and configuring the guest OS, including firewalls.
★ When this WOULD be the correct answer
This would be correct if the question asked about responsibilities for a PaaS service like Azure App Service, where Microsoft manages the underlying OS and patches it automatically.
Why candidates choose this
Candidates may confuse IaaS with PaaS or assume that since Microsoft provides the VM, they also handle OS-level security, overlooking the clear division in the shared responsibility model.
✗Managing application-level user authentication and authorizationWrong answer — click to see why▾
Why this is wrong here
In the shared responsibility model for IaaS, Microsoft is responsible for the physical infrastructure, while the customer manages application-level security, including user authentication and authorization.
★ When this WOULD be the correct answer
This would be correct in a SaaS scenario, where the provider manages the entire application stack, including user authentication. For example, a question about Microsoft 365 would list managing user access as Microsoft's responsibility.
Why candidates choose this
Candidates may confuse IaaS with PaaS or SaaS, where the provider handles more of the application layer, leading them to incorrectly assign application-level tasks to Microsoft in an IaaS context.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
The Shared Responsibility Model
Key term
Shared responsibility model
The shared responsibility model is a framework that defines which security and compliance tasks are handled by the cloud provider and which are handled by the customer.
Key term
IaaS
IaaS stands for Infrastructure as a Service, which means renting virtual computing resources like servers, storage, and networking from a cloud provider instead of buying and managing physical hardware yourself.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.