Shared Responsibility Model: Who Secures What in Azure?
A company is migrating its on-premises applications to Azure. The CIO states that the company is fully responsible for managing the security of its own applications and data, while Microsoft is responsible for the security of the underlying physical infrastructure, such as hardware and data centers. This division of security responsibilities is an example of which concept?
Quick Answer
The answer is the shared responsibility model, which is the correct choice because it defines the clear division of security obligations between Microsoft and the customer in Azure. In this scenario, Microsoft secures the physical infrastructure—hardware, data centers, and networking—while the company retains full responsibility for securing its own applications, data, and identity management. On the SC-900 exam, this concept tests your understanding of how security ownership shifts depending on the service model (IaaS, PaaS, SaaS); a common trap is assuming Microsoft handles everything for IaaS, but the customer always manages data and access. A helpful memory tip is to think of it as “Microsoft owns the floor, you own what’s on it”—the provider protects the building, but you lock your own doors and guard your files.
⚠ Common exam trap
It's easy for candidates to confuse the shared responsibility model with defense in depth, because both involve multiple security layers, but the question specifically asks about the division of responsibilities between provider and customer, not the layering of controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Shared responsibility model
The scenario directly describes the shared responsibility model, which delineates security obligations between the cloud provider and the customer. Microsoft secures the physical infrastructure (hardware, data centers, networking), while the customer is responsible for securing their own applications, data, and identity management. This division is a foundational concept in cloud computing, explicitly defined in Microsoft's documentation for Azure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Defense in depth
Why it's wrong here
Defense in depth is a strategy that layers multiple security controls (e.g., firewalls, antivirus, access controls) to protect against threats. While important, it does not define the division of responsibilities between a cloud provider and customer.
When this WOULD be correct
Defense in depth would be correct if the question asked about a security strategy that uses multiple layers of controls (e.g., network, endpoint, application) to protect resources, such as 'An organization implements firewalls, antivirus, and encryption to protect data. This is an example of which concept?'
- ✓
Shared responsibility model
Why this is correct
The shared responsibility model clearly delineates security responsibilities between the cloud provider (Microsoft) and the customer. In IaaS, the customer manages more (applications, data) while the provider secures the physical layer; in PaaS/SaaS, the provider takes on more responsibility.
- ✗
Zero Trust
Why it's wrong here
Zero Trust is a security model that assumes no implicit trust and verifies every access request regardless of origin. It does not specifically define provider/customer responsibilities.
When this WOULD be correct
A question asking: 'A company implements a security strategy that requires authentication and authorization for every access request, regardless of the network location. This approach is an example of which concept?' would make Zero Trust the correct answer.
- ✗
Least privilege
Why it's wrong here
Least privilege is an identity and access management principle where users are granted only the permissions necessary to perform their job functions. It is not about cloud provider responsibilities.
When this WOULD be correct
Least privilege would be correct in a question about access control, such as: 'A company wants to ensure that employees only have the minimum permissions needed to perform their job functions. Which security concept does this describe?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Shared responsibility modelCorrect answer▾
Why this is correct
The shared responsibility model clearly delineates security responsibilities between the cloud provider (Microsoft) and the customer. In IaaS, the customer manages more (applications, data) while the provider secures the physical layer; in PaaS/SaaS, the provider takes on more responsibility.
✗Defense in depthWrong answer — click to see why▾
Why this is wrong here
The question describes a division of security responsibilities between the customer and Microsoft, which is the definition of the shared responsibility model, not defense in depth. Defense in depth is a layered security approach, not a division of responsibilities.
★ When this WOULD be the correct answer
Defense in depth would be correct if the question asked about a security strategy that uses multiple layers of controls (e.g., network, endpoint, application) to protect resources, such as 'An organization implements firewalls, antivirus, and encryption to protect data. This is an example of which concept?'
Why candidates choose this
Candidates may confuse defense in depth with shared responsibility because both involve multiple security layers, but defense in depth focuses on layered controls within a single entity's environment, not on dividing responsibilities between parties.
✗Zero TrustWrong answer — click to see why▾
Why this is wrong here
Zero Trust is a security model based on the principle of 'never trust, always verify,' not a division of responsibilities between a cloud provider and a customer. The question specifically describes a shared responsibility for security, which is the shared responsibility model.
★ When this WOULD be the correct answer
A question asking: 'A company implements a security strategy that requires authentication and authorization for every access request, regardless of the network location. This approach is an example of which concept?' would make Zero Trust the correct answer.
Why candidates choose this
Candidates may confuse Zero Trust with the shared responsibility model because both involve security concepts in cloud environments, but Zero Trust focuses on access control rather than responsibility allocation.
✗Least privilegeWrong answer — click to see why▾
Why this is wrong here
The question describes a division of security responsibilities between the customer and Microsoft, which is the definition of the shared responsibility model. Least privilege is a principle of granting only necessary access, not a model for dividing security responsibilities.
★ When this WOULD be the correct answer
Least privilege would be correct in a question about access control, such as: 'A company wants to ensure that employees only have the minimum permissions needed to perform their job functions. Which security concept does this describe?'
Why candidates choose this
Candidates may confuse least privilege with the shared responsibility model because both involve distributing security tasks, but least privilege focuses on user permissions, not provider-customer responsibility division.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Shared responsibility
Shared responsibility is a cloud security model where the cloud provider and the customer each own distinct parts of security and compliance duties.
Key term
Identity
Identity is the unique set of attributes that defines a user, device, or service in a computer system, determining what they can access and do.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is migrating its on-premises applications to Azure Infrastructure-as-a-Service (IaaS). According to the shared responsibility model, which of the following security responsibilities shifts from the customer to Microsoft during this migration?
medium- ✓ A.Physical security of the data center infrastructure
- B.Configuring network security groups (NSGs)
- C.Patching the operating system on virtual machines
- D.Managing user identities and access to the application
Why A: When migrating on-premises applications to Azure IaaS, the shared responsibility model shifts physical security responsibilities—such as data center access controls, environmental controls, and hardware security—from the customer to Microsoft. Microsoft is responsible for the physical security of all Azure data centers, including perimeter security, surveillance, and facility access management, which were previously the customer's responsibility in their own on-premises environment.
Variation 2. An organization is migrating its on-premises applications to Azure Infrastructure-as-a-Service (IaaS). According to the shared responsibility model, which of the following security responsibilities remain with Microsoft? (Select two.)
medium- ✓ A.Physical security of the datacenters
- ✓ B.Network controls at the hypervisor layer
- C.Patching the guest operating system on the VM
- D.Configuring network security group (NSG) firewall rules
Why A: In the shared responsibility model for IaaS, Microsoft retains responsibility for the physical security of its datacenters, including access controls, surveillance, and environmental protections. Additionally, Microsoft manages security at the hypervisor layer, which includes network controls that isolate virtual machines from each other and from the underlying host. These responsibilities are inherent to the infrastructure provider and cannot be delegated to the customer.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.