MS-900 Describe cloud concepts Practice Question
A service owner is comparing Microsoft 365 capabilities and needs to understand which security tasks Microsoft handles and which remain with the customer. Cloud concept or benefit best matches this requirement?
⚠ Common exam trap
It's easy for candidates to confuse specific security features (like DLP or sensitivity labels) with the overarching responsibility framework, failing to recognize that the shared responsibility model is the foundational concept that explains the division of security tasks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Shared responsibility model
The shared responsibility model defines which security tasks are handled by Microsoft (e.g., physical security, hypervisor patching) and which remain with the customer (e.g., user access management, data classification). This directly matches the service owner's need to understand the division of security responsibilities in Microsoft 365.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Planner
Why it's wrong here
Microsoft Planner is a task and plan management tool for organising team work; it holds no information about which security duties Microsoft performs versus the customer. It is tempting because it is a Microsoft 365 service, but it would be correct when the requirement is to assign and track tasks, not to explain the shared responsibility model.
- ✗
Data Loss Prevention (DLP)
Why it's wrong here
Data Loss Prevention detects and blocks sensitive information leaving the tenant; it enforces policy rather than defining who owns which security task. It is tempting because it is a Microsoft 365 security feature, but it would be correct when the requirement is to prevent exfiltration of regulated data, not to explain the shared responsibility model.
- ✗
Sensitivity labels
Why it's wrong here
Sensitivity labels classify and protect content through encryption and marking; they do not describe the division of security responsibilities between Microsoft and the customer. They are tempting because they are a Microsoft 365 security control, but they would be correct when the requirement is to apply persistent protection to documents and emails, not to explain the shared responsibility model.
- ✓
Shared responsibility model
Why this is correct
The shared responsibility model defines which security tasks Microsoft handles, such as physical datacentre and host infrastructure, and which remain with the customer, such as data, identities and access. This directly answers the service owner's comparison requirement.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
Learn chapter
Identity Governance and Entitlement Management
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
One of 794 original MS-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.