MS-900 Describe cloud concepts Practice Question
Which two statements correctly describe SaaS in a cloud computing model? (Choose 2.)
⚠ Common exam trap
Watch out — candidates often confuse SaaS with PaaS or IaaS, mistakenly thinking customers are responsible for OS patching (Option C) or deploying their own runtime (Option D), when in fact SaaS abstracts all underlying layers away from the consumer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Users access a complete application provided by the cloud service provider.
In the SaaS model, users access a complete application—such as Microsoft 365—that is hosted and managed entirely by the cloud service provider. The provider handles all aspects of the application, including availability, performance, and security, while the user simply consumes the software via a web browser or client. This aligns with the NIST definition of SaaS, where the consumer does not manage or control the underlying cloud infrastructure or even individual application capabilities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Users access a complete application provided by the cloud service provider.
Why this is correct
In SaaS, the cloud service provider delivers a finished, functional application to end users over the internet, typically through a web browser or thin client. Users do not install, deploy, or host the software on their own devices or servers; they simply consume the hosted application and its features. This is the defining characteristic of the SaaS model, as the customer sees only the application interface and data, not the underlying stack.
- ✓
The provider manages the underlying infrastructure and application platform.
Why this is correct
The SaaS provider manages the entire service stack, including the physical data center, network, servers, operating systems, middleware, runtime, and the application itself. Because of this end-to-end management, the customer's responsibility is limited to tenant configuration, user identities, and data governance. This broad operational scope distinguishes SaaS from PaaS and IaaS, where customers take on progressively more management of the underlying components.
- ✗
Customers manage the operating system patching.
Why it's wrong here
In SaaS, the customer does not manage operating system patching because it has no administrative access to the underlying servers or OS. The provider is responsible for patching, updating, and securing the OS, runtime, and infrastructure as part of the subscribed service. Attempting to patch an OS would require server-level access, which is not available in a true SaaS offering—this is a common responsibility in IaaS, where the customer controls the VM and its OS.
- ✗
Customers deploy their own runtime environment.
Why it's wrong here
In SaaS, customers do not deploy their own runtime environment because the runtime—such as the execution engine, libraries, and middleware—is preinstalled and maintained by the provider. A customer deploying or configuring a runtime would imply they have platform-level control, which is characteristic of PaaS or IaaS, not SaaS. The SaaS model abstracts away the entire environment so that customers only interact with the application itself.
Go deeper
Related to this question
Learn chapter
Cloud Service Types for MS-900
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
This MS-900 question is part of Courseiva's 794-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.