SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A company is deploying a web application on Azure App Service. The security officer states that according to the shared responsibility model, the customer is responsible for managing access to the application and securing the application code. Which of the following responsibilities does Microsoft retain for Azure App Service?
⚠ Common exam trap
Test-takers frequently confuse 'patching the underlying OS' with 'patching the application runtime' or 'configuring network security,' mistakenly thinking Microsoft handles all security tasks for PaaS services, when in fact the customer retains significant control over access and data protection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Patching the underlying operating system of the App Service host
For Azure App Service, Microsoft retains responsibility for patching the underlying operating system of the host infrastructure. This is part of the shared responsibility model where the cloud provider manages the host OS and hypervisor, while the customer manages the application code, data, and access configurations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configuring network firewall rules for the App Service
Why it's wrong here
Configuring network firewall rules for an Azure App Service, such as defining IP restrictions, integrating with Azure Virtual Networks, or setting up private endpoints, is a direct customer responsibility. While Azure secures the underlying network infrastructure, customers must implement application-specific network access controls to protect their web application from unauthorized inbound and outbound traffic. This allows customers to tailor network security to their specific application requirements and threat models.
When this WOULD be correct
This option would be correct in a question about Azure infrastructure services (IaaS), such as a virtual machine, where Microsoft manages the physical host and network, but the customer configures firewall rules for the VM. For example: 'Which of the following is a customer responsibility when using an Azure VM?'
- ✓
Patching the underlying operating system of the App Service host
Why this is correct
As part of the Platform as a Service (PaaS) offering, Microsoft is fully responsible for managing and patching the underlying operating system and virtual machine infrastructure that hosts Azure App Service instances. This includes applying security updates, hotfixes, and service packs to the host OS to maintain platform security and stability, abstracting this operational burden from the customer. This responsibility ensures the foundational environment upon which customer applications run remains secure.
- ✗
Managing user authentication and authorization
Why it's wrong here
Managing user authentication and authorization within an Azure App Service application is a core customer responsibility. This involves integrating the application with identity providers like Microsoft Entra ID, defining application roles, assigning user permissions, and implementing authorization logic within the application code. Customers are accountable for who can access their application and what actions they can perform, ensuring proper access control and preventing unauthorized use.
When this WOULD be correct
This option would be correct in a question about Azure Active Directory (Azure AD) as an identity provider, where Microsoft manages the authentication service itself, including user authentication and authorization for cloud resources.
- ✗
Applying encryption to the application data at rest
Why it's wrong here
Applying encryption to application data at rest, whether stored in Azure Storage, Azure SQL Database, or other data services consumed by the App Service, is a customer's responsibility. Although Azure provides platform-managed encryption for data at rest by default, customers are accountable for ensuring their specific application data is adequately protected, potentially by configuring customer-managed keys (CMK) via Azure Key Vault for enhanced control over encryption keys. This ensures data confidentiality even if the underlying storage is compromised.
When this WOULD be correct
This option would be correct in a question about Azure SQL Database or Azure Storage, where Microsoft manages encryption at rest by default (e.g., transparent data encryption). For example: 'Which responsibility does Microsoft retain for Azure SQL Database?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Patching the underlying operating system of the App Service hostCorrect answer▾
Why this is correct
As part of the Platform as a Service (PaaS) offering, Microsoft is fully responsible for managing and patching the underlying operating system and virtual machine infrastructure that hosts Azure App Service instances. This includes applying security updates, hotfixes, and service packs to the host OS to maintain platform security and stability, abstracting this operational burden from the customer. This responsibility ensures the foundational environment upon which customer applications run remains secure.
✗Configuring network firewall rules for the App ServiceWrong answer — click to see why▾
Why this is wrong here
In Azure App Service, configuring network firewall rules is a customer responsibility, not Microsoft's. The shared responsibility model assigns platform-level security (like OS patching) to Microsoft, but network configuration for the app is managed by the customer.
★ When this WOULD be the correct answer
This option would be correct in a question about Azure infrastructure services (IaaS), such as a virtual machine, where Microsoft manages the physical host and network, but the customer configures firewall rules for the VM. For example: 'Which of the following is a customer responsibility when using an Azure VM?'
Why candidates choose this
Candidates may confuse the shared responsibility model for PaaS (App Service) with IaaS, assuming Microsoft handles all network security. They might also think that because Microsoft manages the platform, it also configures network firewalls for the app.
✗Managing user authentication and authorizationWrong answer — click to see why▾
Why this is wrong here
In Azure App Service, managing user authentication and authorization is a customer responsibility, not Microsoft's. The shared responsibility model assigns application-level access control to the customer.
★ When this WOULD be the correct answer
This option would be correct in a question about Azure Active Directory (Azure AD) as an identity provider, where Microsoft manages the authentication service itself, including user authentication and authorization for cloud resources.
Why candidates choose this
Candidates may confuse the platform's built-in authentication features (which are configurable by the customer) with Microsoft-managed responsibilities, assuming that because Azure offers authentication modules, Microsoft handles all aspects of it.
✗Applying encryption to the application data at restWrong answer — click to see why▾
Why this is wrong here
In the shared responsibility model for Azure App Service, Microsoft is responsible for the physical infrastructure and platform, but encryption of application data at rest is typically the customer's responsibility because they control the data and can enable encryption features like Azure Storage Service Encryption.
★ When this WOULD be the correct answer
This option would be correct in a question about Azure SQL Database or Azure Storage, where Microsoft manages encryption at rest by default (e.g., transparent data encryption). For example: 'Which responsibility does Microsoft retain for Azure SQL Database?'
Why candidates choose this
Candidates may assume that because Azure offers encryption features, Microsoft handles all encryption responsibilities, overlooking that customers must configure and manage encryption for their application data.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Shared responsibility
Shared responsibility is a cloud security model where the cloud provider and the customer each own distinct parts of security and compliance duties.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.