AZ-900 Describe cloud concepts Practice Question
A company uses Azure SQL Database (PaaS). According to the shared responsibility model, who is responsible for applying security patches to the underlying operating system that runs the database service?
⚠ Common exam trap
A common mix-up: candidates confuse PaaS with IaaS, where the customer would be responsible for OS patching, leading them to incorrectly select 'The customer' or 'Both'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft
Microsoft is responsible for applying security patches to the underlying operating system that hosts Azure SQL Database because it is a Platform as a Service (PaaS) offering. In the PaaS shared responsibility model, the cloud provider manages the infrastructure, including the OS, runtime, and network, while the customer is responsible for data and access management. Azure SQL Database abstracts the OS layer entirely, so Microsoft handles all patching and maintenance to ensure security and compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft
Why this is correct
Microsoft is responsible for OS patching because Azure SQL Database is a fully managed PaaS service. The underlying operating system is abstracted from the customer, and Microsoft automatically applies security and routine patches as part of the platform's maintenance, ensuring the service remains secure and compliant without requiring any customer action.
- ✗
The customer
Why it's wrong here
The customer is not responsible for OS patching in Azure SQL Database because they never have direct access to the underlying operating system. PaaS abstracts the infrastructure, so customers manage only their data, schema, and access controls, not the host OS. Attempting to patch the OS would be impossible without control-plane access, and Microsoft performs any required patching transparently on the customer's behalf.
When this WOULD be correct
This option would be correct if the question asked about an IaaS scenario, such as a SQL Server installed on an Azure Virtual Machine, where the customer is responsible for patching the OS.
- ✗
Both
Why it's wrong here
The 'both' option is incorrect because OS patching is not a shared responsibility between Microsoft and the customer for Azure SQL Database. The division of labor in the shared responsibility model is clear: Microsoft manages the host OS entirely, while customers are responsible only for their own data and client-side settings. Therefore, the customer does not participate in any OS patching tasks, making the 'both' answer factually wrong.
When this WOULD be correct
For a question about an IaaS virtual machine running SQL Server, where the customer manages the OS and must apply security patches, 'Both' would be incorrect; but if the question asked about shared responsibility for patching the database software itself in a PaaS environment, 'Both' might be correct if the customer applies some patches via maintenance windows.
- ✗
Neither
Why it's wrong here
The 'neither' option is incorrect because the shared responsibility model clearly assigns OS patching to one party, and that party is Microsoft. The model does not leave OS patching unassigned; for Azure SQL Database, Microsoft explicitly owns the OS layer, including all updates. Saying 'neither' would incorrectly suggest that no provider handles this critical maintenance, which contradicts Azure's actual PaaS management practices.
When this WOULD be correct
This option would be correct in a question about an on-premises SQL Server installation where the customer manages the entire stack, including OS patches, and Microsoft has no responsibility.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓MicrosoftCorrect answer▾
Why this is correct
Microsoft is responsible for OS patching because Azure SQL Database is a fully managed PaaS service. The underlying operating system is abstracted from the customer, and Microsoft automatically applies security and routine patches as part of the platform's maintenance, ensuring the service remains secure and compliant without requiring any customer action.
✗The customerWrong answer — click to see why▾
Why this is wrong here
In the shared responsibility model for Azure SQL Database (PaaS), Microsoft manages the underlying operating system, including security patching, because the customer only manages data and access controls.
★ When this WOULD be the correct answer
This option would be correct if the question asked about an IaaS scenario, such as a SQL Server installed on an Azure Virtual Machine, where the customer is responsible for patching the OS.
Why candidates choose this
Candidates may confuse PaaS with IaaS or assume that since they manage the database, they also manage the OS, not realizing that PaaS abstracts the infrastructure.
✗BothWrong answer — click to see why▾
Why this is wrong here
In the shared responsibility model for Azure SQL Database (PaaS), Microsoft manages the underlying operating system, including security patches. The customer is responsible only for data and access management, not OS patching.
★ When this WOULD be the correct answer
For a question about an IaaS virtual machine running SQL Server, where the customer manages the OS and must apply security patches, 'Both' would be incorrect; but if the question asked about shared responsibility for patching the database software itself in a PaaS environment, 'Both' might be correct if the customer applies some patches via maintenance windows.
Why candidates choose this
Candidates may think that because the customer uses the database, they share responsibility for all security aspects, not realizing that PaaS abstracts the OS, leaving its management entirely to Microsoft.
✗NeitherWrong answer — click to see why▾
Why this is wrong here
In the shared responsibility model for PaaS like Azure SQL Database, Microsoft manages the underlying OS, including security patches. 'Neither' is incorrect because Microsoft is explicitly responsible for OS-level patching.
★ When this WOULD be the correct answer
This option would be correct in a question about an on-premises SQL Server installation where the customer manages the entire stack, including OS patches, and Microsoft has no responsibility.
Why candidates choose this
Candidates may confuse PaaS with IaaS or on-premises, where the customer handles OS patching, leading them to think no one is responsible for a managed service.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
What is Cloud Computing?
Key term
PaaS
Platform as a Service (PaaS) is a cloud computing model that provides a managed platform for developers to build, run, and manage applications without dealing with the underlying infrastructure.
Key term
Shared responsibility
Shared responsibility is a cloud security model where the cloud provider and the customer each own distinct parts of security and compliance duties.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.