SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A company deploys a custom application on Azure App Service (PaaS). Which of the following security responsibilities falls completely under the customer's scope according to the shared responsibility model?
⚠ Common exam trap
Many candidates confuse PaaS with IaaS and assume they must manage OS patches or NSGs, but in PaaS, those are abstracted and Microsoft's responsibility, while the customer's focus is on application-level security.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Managing the application code and its configuration
In the shared responsibility model for PaaS like Azure App Service, the customer is responsible for managing the application code and its configuration, including secrets, connection strings, and authentication settings. Microsoft manages the underlying platform, including the OS and runtime, so the customer's scope is limited to what they deploy and configure within the service.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Applying operating system patches to the virtual machines running the App Service
Why it's wrong here
Azure App Service is a Platform as a Service (PaaS) offering, meaning Microsoft is responsible for managing the underlying infrastructure, including the operating system and its patching. Customers using PaaS services are abstracted from the virtual machines and their OS, so applying patches is a core responsibility of the cloud provider, not the customer. This ensures the platform's foundational security and stability.
- ✗
Configuring network security groups to filter traffic to the App Service
Why it's wrong here
While customers can implement application-level IP restrictions or integrate with services like Azure Front Door for traffic management, the direct configuration and management of Network Security Groups (NSGs) for the underlying App Service infrastructure are handled by Microsoft. NSGs are a foundational network security component, and for PaaS services, the cloud provider maintains these to secure the platform's network layer. Customers focus on application-specific traffic rules rather than infrastructure NSGs.
- ✓
Managing the application code and its configuration
Why this is correct
In the shared responsibility model, the customer always retains full accountability for the security within their deployed application, regardless of the cloud service model. This encompasses developing secure application code, implementing robust authentication and authorization, managing application-level configurations, and ensuring proper data encryption and handling within the application itself. Securing the application layer is a primary customer responsibility to prevent vulnerabilities and data breaches.
- ✗
Ensuring physical security of the Azure data centers
Why it's wrong here
Physical security, which includes safeguarding the data center facilities from unauthorized access, environmental threats, and natural disasters, is a fundamental responsibility that always falls to the cloud provider, Microsoft. Customers never have direct control or responsibility over the physical infrastructure where their cloud resources are hosted. This foundational layer of security is managed entirely by Azure to protect the underlying hardware and facilities.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
Key term
Shared responsibility
Shared responsibility is a cloud security model where the cloud provider and the customer each own distinct parts of security and compliance duties.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.