SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A company uses Azure SQL Database, which is a Platform as a Service (PaaS) offering. The security team is reviewing the shared responsibility model and wants to know who is responsible for applying operating system patches to the underlying infrastructure that hosts the database. Who is responsible for this task?
⚠ Common exam trap
A common mix-up: candidates confuse the shared responsibility model for PaaS with IaaS, mistakenly believing that because Azure SQL Database runs on VMs, the customer must patch the OS, when in fact Microsoft abstracts and manages the entire host OS layer in PaaS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft is responsible for managing and patching the operating system of the underlying infrastructure for PaaS services.
Azure SQL Database is a Platform as a Service (PaaS) offering where Microsoft manages the underlying infrastructure, including the operating system. In the shared responsibility model for PaaS, Microsoft is responsible for applying OS patches to the host servers, while the customer manages the database configuration and data. Therefore, option B correctly identifies Microsoft as responsible for OS patching in this context.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The customer is responsible for patching the OS on virtual machines but not for PaaS; however, the customer must patch the OS for Azure SQL Database.
Why it's wrong here
This statement is incorrect because it contains a fundamental contradiction regarding PaaS responsibilities. While customers are indeed responsible for patching the operating system on virtual machines (IaaS), Azure SQL Database is a Platform as a Service (PaaS) offering. In a PaaS model, Microsoft, not the customer, assumes full responsibility for managing and patching the underlying operating system and infrastructure, meaning the customer does not patch the OS for Azure SQL Database.
- ✓
Microsoft is responsible for managing and patching the operating system of the underlying infrastructure for PaaS services.
Why this is correct
This statement is correct and accurately reflects the shared responsibility model for Platform as a Service (PaaS) offerings like Azure SQL Database. In PaaS, Microsoft manages the entire underlying infrastructure, including the operating system, network controls, and physical hardware. This allows customers to focus their efforts on their applications, data, and configurations, without the operational overhead of OS patching and maintenance.
- ✗
Both the customer and Microsoft share equal responsibility for patching the OS in a PaaS model.
Why it's wrong here
This statement is incorrect because the shared responsibility model in PaaS does not imply equal responsibility for the operating system layer. While responsibilities are shared across different layers of the cloud stack, Microsoft retains full ownership and management of the underlying OS for PaaS services. Customer responsibility typically begins at the application runtime, application code, data, and access management layers, not the infrastructure OS.
- ✗
The cloud service provider partner (e.g., a managed service provider) is responsible for OS patches in PaaS.
Why it's wrong here
This statement is incorrect. While a cloud service provider partner or managed service provider (MSP) can offer valuable services by managing customer-side responsibilities, such as application configuration, data security, or monitoring, the fundamental responsibility for patching the underlying PaaS operating system remains with Microsoft as the cloud provider. An MSP augments customer capabilities but does not assume Microsoft's core infrastructure duties in a PaaS model.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
SQL
SQL is a standardized programming language used to manage and manipulate relational databases, enabling querying, updating, and data retrieval.
Key term
SQL
SQL is a standard programming language used to manage, query, and manipulate relational databases by issuing commands like SELECT, INSERT, UPDATE, and DELETE.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.