SC-900 Practice Question: Describe the concepts of security, compliance, and identity
An organization is migrating its on-premises applications to Azure Infrastructure-as-a-Service (IaaS). According to the shared responsibility model, which of the following security responsibilities remain with Microsoft? (Select two.)
⚠ Common exam trap
Many candidates confuse patching responsibilities, assuming Microsoft patches the guest OS in IaaS, or mistakenly think NSG configuration is a Microsoft responsibility because it is a built-in Azure feature.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Physical security of the datacenters
In the shared responsibility model for IaaS, Microsoft retains responsibility for the physical security of its datacenters, including access controls, surveillance, and environmental protections. Additionally, Microsoft manages security at the hypervisor layer, which includes network controls that isolate virtual machines from each other and from the underlying host. These responsibilities are inherent to the infrastructure provider and cannot be delegated to the customer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Physical security of the datacenters
Why this is correct
Microsoft, as the cloud provider, assumes full responsibility for the physical security of its global datacenters. This encompasses robust perimeter defenses, such as fencing and surveillance, along with strict access controls like biometric authentication for personnel. Furthermore, Microsoft manages environmental controls, including power, cooling, and fire suppression systems, ensuring the foundational infrastructure hosting customer VMs remains physically secure and operational.
- ✓
Network controls at the hypervisor layer
Why this is correct
Microsoft is responsible for the secure operation of the hypervisor and the underlying network fabric that virtualizes resources for customers. This includes managing virtual switches, ensuring logical isolation between different customer tenants, and protecting the virtualization platform itself from attacks. These controls are fundamental to providing a secure, multi-tenant environment where customer VMs can operate without interference from other tenants.
- ✗
Patching the guest operating system on the VM
Why it's wrong here
The customer retains full responsibility for managing and patching the guest operating system installed on their Azure Virtual Machines. This includes applying all necessary security updates, hotfixes, and service packs for the OS (e.g., Windows Server, Linux distributions). While Microsoft patches the underlying host OS and hypervisor, the security posture of the customer's application and data largely depends on their diligent maintenance of the guest OS.
- ✗
Configuring network security group (NSG) firewall rules
Why it's wrong here
Configuring Network Security Group (NSG) firewall rules is explicitly a customer responsibility within the Azure Shared Responsibility Model. NSGs allow customers to define granular inbound and outbound security rules for network traffic to and from Azure resources, such as Virtual Machines. Microsoft provides the NSG service, but the customer must actively create and manage these rules to protect their specific applications and data.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.