SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A company deploys a custom web application on Azure App Service (PaaS). The application stores data in Azure SQL Database. The security team needs to identify which security responsibilities fall under the customer according to the Microsoft shared responsibility model. Which of the following is primarily the customer's responsibility for this PaaS deployment?
⚠ Common exam trap
Candidates often assume PaaS means Microsoft handles all security, but the customer still owns identity and access management for the application and data, which is a frequent exam distraction.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Managing user identities and access to the application
In a PaaS deployment like Azure App Service with Azure SQL Database, the customer is responsible for managing user identities and access to the application, including authentication, authorization, and role-based access control (RBAC). Microsoft manages the underlying infrastructure, including the host OS, physical datacenter security, and network backbone, but the customer must secure application-level access and data plane operations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Physical security of the datacenter hosting the App Service
Why it's wrong here
In the Azure Shared Responsibility Model, physical security of the underlying infrastructure, including datacenters, servers, and networking hardware, is exclusively Microsoft's responsibility. This applies universally across all cloud service models (IaaS, PaaS, SaaS). Customers deploying applications on Azure App Service (a PaaS offering) are not involved in securing the physical facilities that house their application's compute resources, as this falls under Microsoft's 'security of the cloud' domain.
- ✗
Patching the operating system of the App Service host machines
Why it's wrong here
Azure App Service is a Platform-as-a-Service (PaaS) offering, meaning Microsoft manages the underlying operating system (OS) of the host machines that run customer applications. This management includes routine patching, security updates, and maintenance to ensure the platform's stability and security. Customers are abstracted from the host OS and are not responsible for its patching, allowing them to focus solely on their application code and configuration.
- ✓
Managing user identities and access to the application
Why this is correct
While Azure App Service provides the platform, the customer retains full responsibility for managing user identities and controlling access to their custom web application. This includes implementing authentication mechanisms (e.g., integrating with Azure AD, OAuth, or custom identity providers), defining authorization policies, and assigning appropriate roles to users. Microsoft provides the tools and services, but the customer configures and enforces who can access their specific application, which is a key aspect of 'security in the cloud'.
- ✗
Network security for the Azure backbone connecting datacenters
Why it's wrong here
The security of the Azure backbone network, which interconnects Microsoft's global datacenters and provides high-speed, resilient connectivity, is entirely Microsoft's responsibility. This encompasses the physical network infrastructure, routing, and core network services that ensure the platform's integrity. Customers are responsible for configuring network security *within* their virtual networks, such as Network Security Groups (NSGs) and application gateway rules, but not the underlying global backbone infrastructure.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
Shared responsibility
Shared responsibility is a cloud security model where the cloud provider and the customer each own distinct parts of security and compliance duties.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.