SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A company is migrating its on-premises applications to Azure Infrastructure-as-a-Service (IaaS). According to the shared responsibility model, which of the following security responsibilities shifts from the customer to Microsoft during this migration?
⚠ Common exam trap
It's easy for candidates to confuse IaaS with PaaS or SaaS, mistakenly believing that Microsoft takes responsibility for OS patching or network security in IaaS, when in fact those remain customer responsibilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Physical security of the data center infrastructure
When migrating on-premises applications to Azure IaaS, the shared responsibility model shifts physical security responsibilities—such as data center access controls, environmental controls, and hardware security—from the customer to Microsoft. Microsoft is responsible for the physical security of all Azure data centers, including perimeter security, surveillance, and facility access management, which were previously the customer's responsibility in their own on-premises environment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Physical security of the data center infrastructure
Why this is correct
In the Azure Shared Responsibility Model, particularly for Infrastructure as a Service (IaaS) deployments, the cloud provider (Microsoft) is solely responsible for the physical security of the underlying data centers. This includes implementing robust access controls, continuous surveillance, environmental monitoring, and fire suppression systems to protect the hardware and infrastructure where customer data resides. Customers do not have any control or responsibility over the physical facilities.
- ✗
Configuring network security groups (NSGs)
Why it's wrong here
Configuring Network Security Groups (NSGs) is a customer responsibility within an Infrastructure as a Service (IaaS) deployment. NSGs allow customers to filter network traffic to and from Azure resources in an Azure virtual network, enabling granular control over inbound and outbound communication for virtual machines and subnets. Microsoft provides the NSG service, but the customer defines and manages the security rules.
- ✗
Patching the operating system on virtual machines
Why it's wrong here
For virtual machines deployed under the Infrastructure as a Service (IaaS) model, the customer retains full responsibility for patching and updating the guest operating system. This includes applying security updates, bug fixes, and feature enhancements to the OS (e.g., Windows Server, Linux distributions) and any applications installed on the VM. Microsoft manages the host infrastructure, but not the guest OS.
- ✗
Managing user identities and access to the application
Why it's wrong here
Managing user identities and controlling access to applications is consistently a customer responsibility across all cloud service models, including IaaS. While Azure Active Directory (Azure AD) provides the identity platform, the customer is accountable for provisioning users, assigning roles, configuring multi-factor authentication, and defining access policies to secure their applications and data. This ensures proper authentication and authorization.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Shared responsibility
Shared responsibility is a cloud security model where the cloud provider and the customer each own distinct parts of security and compliance duties.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.