MS-900 Describe cloud concepts Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The cloud provider is fully responsible for patching all components.

  Why it's wrong here

  This statement is incorrect in an IaaS deployment such as virtual machines. The cloud provider is responsible only for patching the physical infrastructure, including the hardware, network, storage, and the hypervisor layer that hosts your VMs. However, the customer retains full responsibility for the guest operating system and all installed applications, including applying security updates. Thus, claiming the provider patches 'all components' ignores the explicit customer duties that remain in the shared responsibility model.

• ✓

  The customer is responsible for patching the operating system of the virtual machines.

  Why this is correct

  This is the correct statement for an IaaS virtual machine. Because the customer provisions and controls the VM, they are accountable for the guest operating system and must apply patches, including critical security updates, to that OS. The provider manages the underlying physical hosts and the hypervisor, but does not access or modify the guest OS unless the customer explicitly enables a management or patching service. Therefore, the customer must have an ongoing patching process for the VM's operating system to maintain security and compliance.

• ✗

  The cloud provider patches the OS for all services equally.

  Why it's wrong here

  This is false because patching responsibilities vary dramatically across cloud service models. In SaaS, the provider patches the entire service, including the OS, but in IaaS the provider does not patch the guest OS of your VMs—you do. Even within a single provider, different services have different shared-responsibility boundaries; for example, Azure App Service (PaaS) patches the OS for you, while Azure VMs (IaaS) do not. Thus, the provider does not patch the OS 'for all services equally'—the responsibility is model-dependent.

• ✗

  No patching is needed because the cloud handles everything.

  Why it's wrong here

  This is a misconception that ignores the fundamental shared responsibility model. Though the cloud provider manages the physical data center and often the virtualization layer, patching is still required for any component the customer owns. In an IaaS VM, the guest OS is under the customer's control, so the provider cannot automatically patch it; leaving it unpatched can expose the workload to vulnerabilities. Therefore, the cloud does not 'handle everything'—the customer must actively patch and maintain the OS and applications within their scope.