SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A security administrator is explaining the shared responsibility model to a new team member. The company uses a Software-as-a-Service (SaaS) application such as Microsoft 365. For which of the following items is the customer primarily responsible under this model?
⚠ Common exam trap
Many exam-takers confuse operational tasks like patching or physical security with customer responsibilities, failing to recognize that in SaaS the provider handles all infrastructure and application maintenance, leaving only identity and data governance to the customer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Managing user access and classifying data stored in the service
In the shared responsibility model for SaaS like Microsoft 365, the customer is responsible for managing user access (e.g., configuring Azure AD roles, conditional access policies, and multi-factor authentication) and classifying data stored in the service (e.g., applying sensitivity labels via Microsoft Purview Information Protection). The provider manages the underlying infrastructure, including physical security, hypervisor patching, and application updates.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Physical security of the data center hosting the SaaS application
Why it's wrong here
In a Software as a Service (SaaS) model, the cloud provider assumes full responsibility for the underlying physical infrastructure. This includes the physical security of the data centers, encompassing environmental controls, access management, and surveillance systems. Customers merely consume the application and have no control or responsibility over the physical premises where the service operates.
- ✗
Patching the hypervisor that runs the SaaS infrastructure
Why it's wrong here
Patching the hypervisor is unequivocally the cloud provider's responsibility within a SaaS offering. The hypervisor is a core component of the virtualization layer, managing the virtual machines that host the SaaS application, and is entirely abstracted from the customer. Customers are not granted access or control over this foundational infrastructure element.
- ✓
Managing user access and classifying data stored in the service
Why this is correct
Managing user access and classifying data stored within the SaaS application are critical customer responsibilities. The customer defines who can access their organizational data, what permissions they have, and how sensitive that data is, directly impacting data governance and compliance. This ensures that customer-specific information remains secure and properly handled according to internal policies and regulatory mandates.
- ✗
Applying security updates to the SaaS application itself
Why it's wrong here
Applying security updates to the SaaS application itself falls squarely on the cloud provider. In a SaaS model, the provider manages the entire application stack, including its code, runtime, and underlying operating systems. Customers consume the service as-is and do not have the capability or responsibility to patch or update the core application logic.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.