MS-900 Describe cloud concepts Practice Question
A healthcare organization must keep sensitive patient data on-premises due to regulatory compliance, but wants to use cloud services for other applications like customer relationship management and collaboration. Which cloud deployment model best meets this requirement?
⚠ Common exam trap
Many candidates confuse 'private cloud' as the only compliant option for sensitive data, overlooking that hybrid cloud allows the organization to meet compliance for specific workloads while still benefiting from public cloud economics for others.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Hybrid cloud
The hybrid cloud model is correct because it allows the healthcare organization to keep sensitive patient data on-premises (private cloud) for regulatory compliance (e.g., HIPAA), while leveraging public cloud services for customer relationship management and collaboration tools like Microsoft Dynamics 365 and Microsoft 365. This deployment model provides a unified environment where workloads can be distributed across on-premises and cloud infrastructure, ensuring data sovereignty and compliance without sacrificing scalability or cost efficiency.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Public cloud
Why it's wrong here
Public cloud resources are provisioned on a provider-owned, multi-tenant infrastructure (such as Azure, AWS, or Google Cloud) operated from external datacenters. Because data is processed and stored off-premises and shares underlying hardware with other customers, a public cloud deployment alone cannot satisfy a requirement to keep sensitive patient data on-premises; additional solutions like Azure Stack or a hybrid architecture would be needed.
- ✗
Private cloud
Why it's wrong here
A private cloud is a single-tenant environment dedicated to one organization, but the architecture does not guarantee an on-premises footprint — it is often operated in a vendor's or colocation facility off-premises. Even when deployed on-premises, a purely private cloud does not inherently provide the integrated mix of local infrastructure and public cloud services that hybrid cloud offers, so it fails to meet the stated requirement.
- ✓
Hybrid cloud
Why this is correct
A hybrid cloud combines an organization's on-premises infrastructure, such as an Azure Stack edge device or local datacenter, with public cloud services via a secure connection like VPN or ExpressRoute. This allows sensitive patient data to remain resident in the on-premises environment while compute and storage for non-sensitive workloads scale into the public cloud, directly satisfying the stated requirement.
- ✗
Community cloud
Why it's wrong here
A community cloud is a shared multi-tenant platform tailored for organizations with common regulatory or compliance needs (for example, multiple hospitals), but it is still hosted off-premises by a provider or third party. Although it may offer healthcare-specific compliance certifications, it does not by design keep data on-premises; therefore it cannot fulfill a requirement for sensitive patient data to remain in the organization's own infrastructure.
Go deeper
Related to this question
Learn chapter
Cloud Service Types for MS-900
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
Key term
Collaboration
Collaboration in Microsoft 365 refers to the integrated tools and services that enable people to work together in real time, share information, and coordinate tasks from anywhere.
About these practice questions
One of 217 original MS-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.