SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A company subscribes to a cloud-based email service that is delivered as Software-as-a-Service (SaaS). According to the shared responsibility model, who is primarily responsible for the physical security of the data centers where the email data is stored?
⚠ Common exam trap
Many candidates confuse the shared responsibility model for IaaS or PaaS with SaaS, incorrectly assuming the customer has some physical security duties, when in fact for SaaS the provider handles all physical and infrastructure security.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The cloud provider
In the shared responsibility model for SaaS, the cloud provider is responsible for the physical security of the data centers, including hardware, network infrastructure, and physical access controls. The customer is responsible for securing their own data, user access, and compliance within the service, but not the underlying physical infrastructure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The customer
Why it's wrong here
In a Software as a Service (SaaS) model, such as a cloud-based email service, the cloud provider assumes full responsibility for the underlying infrastructure. This includes managing the physical data centers, servers, networking hardware, and environmental controls. The customer's security responsibilities are limited to their data, user access management, and application configurations, not the physical security of the facilities housing the service.
- ✓
The cloud provider
Why this is correct
For a cloud-based email service, which exemplifies Software as a Service (SaaS), the cloud provider is unequivocally responsible for the physical security of the entire underlying infrastructure. This encompasses securing the data centers, controlling physical access, maintaining environmental conditions, and protecting the servers, storage, and networking hardware that host the email application. Their robust security measures ensure the integrity and availability of the service at the foundational level.
- ✗
Both the customer and the cloud provider equally
Why it's wrong here
While the shared responsibility model dictates that both the customer and the cloud provider have security obligations, these responsibilities are not equally distributed across all domains, especially not for physical security in a SaaS offering. The cloud provider maintains exclusive control over the physical infrastructure, meaning the customer has no access or authority to implement physical security measures within the provider's data centers. Therefore, physical security is a clear demarcation point where the provider's responsibility is absolute.
- ✗
Neither the customer nor the cloud provider
Why it's wrong here
Security responsibilities in cloud computing are always explicitly assigned, not left unaddressed, particularly for critical aspects like physical security. In the context of a SaaS email service, the cloud provider explicitly assumes the duty of safeguarding the physical data centers and hardware that underpin the service. Failing to assign this crucial responsibility would create significant security vulnerabilities and contradict the fundamental principles of secure cloud service delivery.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.