SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A company deploys a virtual machine on Azure IaaS. According to the Microsoft shared responsibility model, which of the following security responsibilities is primarily the customer's responsibility?
⚠ Common exam trap
It's easy for candidates to confuse IaaS with PaaS or SaaS, assuming Microsoft handles OS patching, but in IaaS the customer retains full control and responsibility for the guest OS and applications.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Patching the guest operating system and applications
In the Microsoft shared responsibility model, the customer is responsible for securing and patching the guest operating system and applications running on an Azure IaaS virtual machine. Microsoft manages the physical infrastructure, hypervisor, and network, while the customer controls the OS, applications, and data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Physical security of the data centers
Why it's wrong here
In an Azure IaaS deployment, the physical security of the data centers, including access controls, environmental controls, and surveillance, is entirely the responsibility of Microsoft. As the cloud provider, Microsoft owns and operates the underlying infrastructure, ensuring the physical protection of the servers, networking hardware, and facilities where customer virtual machines reside. Customers have no direct control or responsibility over this foundational layer of security, making it a Microsoft-managed aspect.
- ✓
Patching the guest operating system and applications
Why this is correct
For a virtual machine deployed on Azure IaaS, the customer retains full responsibility for managing the guest operating system, including all necessary security updates, patches, and configurations. This also extends to any applications installed within that OS, such as web servers or databases. Unlike PaaS or SaaS, where the provider handles these updates, IaaS requires the customer to actively maintain the software stack running inside their virtual machines to ensure security and performance.
- ✗
Ensuring the hypervisor is secured
Why it's wrong here
The security and maintenance of the hypervisor, which is the software layer that creates and runs virtual machines, falls squarely within Microsoft's responsibilities in an IaaS model. Customers deploying VMs on Azure IaaS do not have direct access to or control over the hypervisor itself. Microsoft is accountable for patching, configuring, and securing this critical virtualization layer to protect the integrity and isolation of all hosted virtual machines.
- ✗
Maintaining the network infrastructure
Why it's wrong here
The maintenance and security of the underlying network infrastructure, encompassing physical network devices, cabling, and core routing, are exclusively managed by Microsoft. While customers configure their virtual networks and network security groups within Azure, the operational upkeep, patching, and physical integrity of the global network fabric that connects Azure data centers and hosts customer resources remain Microsoft's domain. This ensures reliable and secure connectivity for all IaaS deployments.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Shared responsibility
Shared responsibility is a cloud security model where the cloud provider and the customer each own distinct parts of security and compliance duties.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.