Question 1,229 of 1,411

Describe the concepts of security, compliance, and identity →easyMultiple ChoiceObjective-mapped

Quick Answer

The answer is managing user access and classifying data stored in the service. This is correct because under the shared responsibility model for SaaS, the cloud provider handles the underlying infrastructure, application code, and physical security, while the customer retains control over their own data and who can access it. For a service like Microsoft 365, that means you are responsible for configuring Azure AD roles, conditional access policies, and multi-factor authentication, as well as applying sensitivity labels through Microsoft Purview to classify and protect your data. On the SC-900 exam, this concept often appears in questions that test your ability to distinguish between provider-managed layers (like hypervisor patching) and customer-managed layers (like user permissions and data classification). A common trap is assuming the provider handles identity management, but remember: in SaaS, the customer always owns identity and data governance. Memory tip: "SaaS means you secure the seats and the secrets—the provider secures the servers."

SC-900 Practice Question: Describe the concepts of security, compliance, and identity

This SC-900 practice question tests your understanding of describe the concepts of security, compliance, and identity. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A security administrator is explaining the shared responsibility model to a new team member. The company uses a Software-as-a-Service (SaaS) application such as Microsoft 365. For which of the following items is the customer primarily responsible under this model?

Question 1easymultiple choice

Full question →

A
Physical security of the data center hosting the SaaS application
Why wrong: Physical security of the data center is the responsibility of the cloud provider, not the customer.
B
Patching the hypervisor that runs the SaaS infrastructure
Why wrong: Patching the hypervisor is a responsibility of the cloud provider because it is part of the underlying infrastructure in a SaaS model.
C
Managing user access and classifying data stored in the service
The customer is responsible for their own data, including managing who has access, classifying information, and ensuring data is handled in accordance with compliance requirements.
D
Applying security updates to the SaaS application itself
Why wrong: The cloud provider is responsible for maintaining and updating the SaaS application code and infrastructure.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Managing user access and classifying data stored in the service

In the shared responsibility model for SaaS like Microsoft 365, the customer is responsible for managing user access (e.g., configuring Azure AD roles, conditional access policies, and multi-factor authentication) and classifying data stored in the service (e.g., applying sensitivity labels via Microsoft Purview Information Protection). The provider manages the underlying infrastructure, including physical security, hypervisor patching, and application updates.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Physical security of the data center hosting the SaaS application
Why it's wrong here
Physical security of the data center is the responsibility of the cloud provider, not the customer.
✗
Patching the hypervisor that runs the SaaS infrastructure
Why it's wrong here
Patching the hypervisor is a responsibility of the cloud provider because it is part of the underlying infrastructure in a SaaS model.
✓
Managing user access and classifying data stored in the service
Why this is correct
The customer is responsible for their own data, including managing who has access, classifying information, and ensuring data is handled in accordance with compliance requirements.
Related concept
Read the scenario before looking for a memorised answer.
✗
Applying security updates to the SaaS application itself
Why it's wrong here
The cloud provider is responsible for maintaining and updating the SaaS application code and infrastructure.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates often confuse operational tasks like patching or physical security with customer responsibilities, failing to recognize that in SaaS the provider handles all infrastructure and application maintenance, leaving only identity and data governance to the customer.

Detailed technical explanation

How to think about this question

Under the shared responsibility model for SaaS, the provider maintains the entire stack from physical hardware to application runtime, while the customer retains control over identity management (e.g., Azure AD B2B guest user policies) and data classification (e.g., using Microsoft Purview to apply retention labels or DLP policies). A real-world scenario is a customer misconfiguring a SharePoint Online external sharing policy, leading to data leakage—this falls under customer responsibility, not the provider's.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related SC-900 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Describe the capabilities of Microsoft Entra practice questions

Practise SC-900 questions linked to Describe the capabilities of Microsoft Entra.

Describe the capabilities of Microsoft security solutions practice questions

Practise SC-900 questions linked to Describe the capabilities of Microsoft security solutions.

Describe the capabilities of Microsoft compliance solutions practice questions

Practise SC-900 questions linked to Describe the capabilities of Microsoft compliance solutions.

Describe the concepts of security, compliance, and identity practice questions

Practise SC-900 questions linked to Describe the concepts of security, compliance, and identity.

SC-900 fundamentals practice questions

Practise SC-900 questions linked to SC-900 fundamentals.

SC-900 scenario practice questions

Practise SC-900 questions linked to SC-900 scenario.

SC-900 troubleshooting practice questions

Practise SC-900 questions linked to SC-900 troubleshooting.

Practice this exam

Start a free SC-900 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

SC-900 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this SC-900 question test?

Describe the concepts of security, compliance, and identity — This question tests Describe the concepts of security, compliance, and identity — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: Managing user access and classifying data stored in the service — In the shared responsibility model for SaaS like Microsoft 365, the customer is responsible for managing user access (e.g., configuring Azure AD roles, conditional access policies, and multi-factor authentication) and classifying data stored in the service (e.g., applying sensitivity labels via Microsoft Purview Information Protection). The provider manages the underlying infrastructure, including physical security, hypervisor patching, and application updates.

What should I do if I get this SC-900 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.