AZ-900 Describe cloud concepts Practice Question
A company is migrating its on-premises virtual machines (VMs) to Azure using the Infrastructure as a Service (IaaS) model. The VMs run a custom legacy application that requires specific OS-level configurations. The company's IT team wants to understand which party is responsible for applying operating system security patches after the migration. According to the shared responsibility model, who is responsible for patching the OS of the Azure VMs?
⚠ Common exam trap
Many candidates assume Microsoft patches everything in the cloud, but the shared responsibility model clearly delineates that OS patching in IaaS is the customer's duty, not Microsoft's.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The company is responsible for patching the operating system on the virtual machines.
In the shared responsibility model for IaaS, the customer retains control over the operating system, including applying security patches. Microsoft manages the physical host, hypervisor, and Azure infrastructure, but the customer is responsible for OS-level configurations and updates on their virtual machines. This applies to both Windows and Linux VMs, regardless of whether the OS is provided by Azure or the customer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft is fully responsible for applying OS patches to the virtual machines.
Why it's wrong here
Microsoft is not responsible for patching the guest OS on a customer-deployed VM, nor can it automatically do so without explicit customer authorization and configuration. In IaaS, Microsoft only patches the physical infrastructure and virtualization layer; the customer's VM is an isolated environment with its own operating system that Microsoft has no default access to. The company must apply OS patches itself, though it can use Azure tools like Update Management to automate the process.
When this WOULD be correct
This would be correct if the question specified a PaaS service like Azure App Service or a SaaS offering like Microsoft 365, where Microsoft manages the OS and applies patches automatically.
- ✓
The company is responsible for patching the operating system on the virtual machines.
Why this is correct
Under the shared responsibility model for Infrastructure-as-a-Service (IaaS), the customer retains full control over the guest operating system, including applying security updates and patches. Even though the VM runs on Azure physical hardware, Microsoft's responsibility stops at the hypervisor boundary. Because the company has administrative access to the VM, it alone must keep the OS patched and compliant.
- ✗
Responsibility is shared equally between Microsoft and the company for OS patching.
Why it's wrong here
This is incorrect because responsibility for OS patching is not split equally between Microsoft and the customer; instead, the responsibilities are distinct and non-overlapping. Microsoft manages the physical hosts, network fabric, and hypervisor, while the customer manages everything inside the VM, including the guest OS and its patches. There is no shared responsibility for the same component—each party has its own separate layer to maintain.
- ✗
Responsibility depends on whether the VM uses Windows or Linux; Microsoft patches Windows VMs and the company patches Linux VMs.
Why it's wrong here
Incorrect. Microsoft does not automatically patch the guest OS of any VM regardless of the OS type. The customer is responsible for maintaining the OS on all IaaS VMs, though Microsoft offers update management tools to assist.
When this WOULD be correct
This option would be correct if the question specified that the VMs are managed by Azure, such as Azure App Service or Azure SQL Database, where Microsoft handles OS patching for Windows and Linux platforms.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓The company is responsible for patching the operating system on the virtual machines.Correct answer▾
Why this is correct
Under the shared responsibility model for Infrastructure-as-a-Service (IaaS), the customer retains full control over the guest operating system, including applying security updates and patches. Even though the VM runs on Azure physical hardware, Microsoft's responsibility stops at the hypervisor boundary. Because the company has administrative access to the VM, it alone must keep the OS patched and compliant.
✗Microsoft is fully responsible for applying OS patches to the virtual machines.Wrong answer — click to see why▾
Why this is wrong here
In IaaS, the customer retains responsibility for OS-level configurations and security patches, as Microsoft only manages the underlying physical infrastructure and hypervisor.
★ When this WOULD be the correct answer
This would be correct if the question specified a PaaS service like Azure App Service or a SaaS offering like Microsoft 365, where Microsoft manages the OS and applies patches automatically.
Why candidates choose this
Candidates may mistakenly believe that since Azure is a Microsoft platform, Microsoft handles all patching, overlooking the shared responsibility model's distinction between IaaS and higher-level services.
✗Responsibility depends on whether the VM uses Windows or Linux; Microsoft patches Windows VMs and the company patches Linux VMs.Wrong answer — click to see why▾
Why this is wrong here
In the shared responsibility model for IaaS, the customer is responsible for all OS-level configurations and patching, regardless of the OS type. Microsoft only patches the underlying host infrastructure, not the guest OS.
★ When this WOULD be the correct answer
This option would be correct if the question specified that the VMs are managed by Azure, such as Azure App Service or Azure SQL Database, where Microsoft handles OS patching for Windows and Linux platforms.
Why candidates choose this
Candidates may assume that Microsoft provides different levels of support for Windows vs. Linux, or that Azure automatically patches Windows VMs, leading to a misconception about shared responsibility based on OS type.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
The Shared Responsibility Model
Key term
Hypervisor
A hypervisor is software that creates and runs virtual machines by allowing multiple operating systems to share a single hardware host.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.