SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A company uses a cloud-based SaaS (Software as a Service) application for customer relationship management. According to the shared responsibility model, which security responsibility is primarily handled by the customer?
⚠ Common exam trap
Watch out — candidates often assume the customer is responsible for patching the application code in SaaS, but in reality, the provider handles all code-level patches, while the customer only manages user access and permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Managing user access and permissions for the application
In a SaaS model like a cloud-based CRM application, the customer is responsible for managing user access and permissions, including identity and access management (IAM), multi-factor authentication (MFA), and role-based access control (RBAC). The cloud provider handles the underlying infrastructure, platform, and application security, but the customer must control who can access the application and what they can do within it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Physical security of the data center hosting the application
Why it's wrong here
In a Software as a Service (SaaS) model, the cloud provider maintains full control and responsibility for the entire underlying infrastructure, including the physical security of the data centers. This encompasses environmental controls, access restrictions, surveillance, and personnel security. The customer merely consumes the application and has no direct involvement or responsibility for the physical premises where the application's data resides.
- ✗
Security of the underlying networking infrastructure
Why it's wrong here
For a SaaS offering, the cloud provider is solely accountable for securing the foundational networking infrastructure, which includes managing network devices like routers, switches, and firewalls, as well as configuring network segmentation and intrusion detection systems. The customer's responsibility begins at the application layer, interacting with the software over the network, but not managing the network itself.
- ✓
Managing user access and permissions for the application
Why this is correct
Even when consuming a SaaS application, the customer retains primary responsibility for defining and managing user identities, roles, and permissions within that specific application. This includes provisioning and de-provisioning user accounts, assigning appropriate access levels based on job functions, and enforcing least privilege principles. The customer dictates who can access what features and data within the software.
- ✗
Applying security patches to the application's code
Why it's wrong here
In a SaaS environment, the cloud provider is fully responsible for the entire application stack, including its development, maintenance, and operational security. This explicitly includes applying all necessary security patches, updates, and bug fixes to the application's underlying code and operating system. The customer consumes the service without needing to manage any software patching or infrastructure maintenance.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Shared responsibility
Shared responsibility is a cloud security model where the cloud provider and the customer each own distinct parts of security and compliance duties.
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.