AZ-900 Describe cloud concepts Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Shared responsibility model

  Why this is correct

  For a hospital migrating patient data to Azure, the shared responsibility model is the correct framework because it explicitly allocates security obligations: the provider secures the physical infrastructure, host network, and hypervisor, while the customer is responsible for data classification, access control, identity management, and encryption of patient records. This clear delineation is essential for meeting HIPAA and other regulatory requirements, as it defines exactly who must implement and enforce which controls before, during, and after the migration.

• ✗

  Defense in depth

  Why it's wrong here

  Defense in depth is incorrect because it describes a layered strategy that combines controls across physical, network, compute, identity, and data tiers to prevent or slow an attack, rather than dividing responsibilities between the hospital and the cloud provider. Under this approach, both parties may contribute overlapping layers—for instance, Azure DDoS protection from the provider and customer-deployed network security groups—but the model itself does not catalog those layers as provider-owned versus customer-owned. The hospital's challenge is determining accountability boundaries, which is a governance question, not a question of how many security layers to stack.

  When this WOULD be correct

  A question asks: 'A company implements firewalls, intrusion detection, and encryption to protect its cloud resources. Which security principle is being applied?' In that context, defense in depth would be correct.

• ✗

  Principle of least privilege

  Why it's wrong here

  The principle of least privilege is not the correct model because it focuses exclusively on granting users and services only the minimal permissions needed to perform their job functions, such as allowing a clinician to access only the patient records necessary for treatment. This is a critical access-control practice that the hospital must configure using Azure RBAC and identity governance, but it does not distinguish between the provider's responsibilities for securing the physical datacenter and the customer's responsibilities for securing data and application access. Therefore, while least privilege helps reduce insider threat risk, it does not establish the overall division of security ownership required for a cloud migration.

  When this WOULD be correct

  A scenario where an organization implements access controls so that each user or system has only the permissions necessary to perform their job functions. For example: 'A company configures its cloud storage so that each employee can only access the folders relevant to their department. Which security principle does this illustrate?'

• ✗

  Zero trust model

  Why it's wrong here

  The zero trust model is not the right answer because it is an operational security philosophy that assumes no implicit trust for any user or device, requiring continuous authentication and authorization for every request, regardless of network location. While implementing zero trust principles like conditional access and microsegmentation is valuable in a hybrid cloud, the model does not define contractual or operational responsibility boundaries between the hospital and the cloud provider. It provides security posture guidance, not an accountability split, so it cannot answer who is responsible for protecting the migrated patient data.

  When this WOULD be correct

  A company wants to implement a security model where no user or device is trusted by default, even if they are inside the corporate network, and every access request must be authenticated and authorized. The correct answer would be Zero Trust.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question