Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Customer Versus Microsoft Responsibilities in Azure
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization is preparing to migrate its infrastructure and applications to Microsoft Azure. During migration planning, the IT team reviews how administrative, operational, and security tasks will be handled in the cloud compared to their on-premises datacenter.
Which statement accurately describes the division of responsibilities under the cloud shared responsibility model?
Explanations
Responsibilities are divided between Microsoft and the customer based on the cloud service model, but the customer always retains responsibility for data and identity management.
Responsibilities are divided between Microsoft and the customer based on the cloud service model, but the customer always retains responsibility for data and identity management.
What the Shared Responsibility Model Is
The shared responsibility model is a core cloud computing framework that defines how operational tasks, management overhead, and security controls are divided between the cloud service provider (Microsoft) and the cloud consumer (the customer).
How It Delineates Responsibilities
In an on-premises deployment, the customer owns and manages the entire stack from physical facilities up to the data. When moving to the cloud, responsibility shifts:
- Responsibilities that shift by service model: Depending on whether Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or Software as a Service (SaaS) is selected, Microsoft assumes varying levels of responsibility for operating systems, application runtimes, and network controls.
- Responsibilities always retained by the customer: Regardless of whether an organization uses IaaS, PaaS, or SaaS, the customer always retains ownership and primary responsibility for their customer data, user identities, account credentials, and endpoint access management.
- Responsibilities managed by Microsoft: Across all cloud models, Microsoft assumes responsibility for physical datacenters, physical hosts, and physical network infrastructure.
Key Advantages of the Model
- Clear governance boundaries: Establishes transparent boundaries for security configuration, compliance tracking, and incident response.
- Reduced administrative burden: Offloads physical infrastructure maintenance and physical facility security to Microsoft.
- Flexibility across workloads: Allows organizations to select service tiers that match their desired balance between control and convenience.
- Consistent data sovereignty: Keeps data ownership and user access control firmly in the hands of the organization.
Why This Is the Accurate Choice
This option accurately reflects that cloud management is a partnership where duties shift depending on the architecture tier, while critical assets like data classification, governance, and identity protection consistently remain the customer's duty.
Microsoft assumes complete responsibility for all security, compliance, data protection, and user account management across all cloud service models.
Microsoft assumes complete responsibility for all security, compliance, data protection, and user account management across all cloud service models.
What Complete Provider Management Implies
This option describes a scenario where the cloud provider manages every layer of the computing environment, including information security, user accounts, and data governance.
Why It Is Incorrect
Cloud providers do not own, inspect, or manage customer data or administrative access credentials. In public cloud computing:
- Microsoft provides the underlying infrastructure and platform tools, but never assumes ownership of customer data or identity access policies.
- Customers must always define access controls, implement authentication safeguards (such as multi-factor authentication), and govern who can read or modify stored records.
- Believing the cloud provider handles all security creates a dangerous security gap known as the shared responsibility misconception.
Key Characteristics of Provider Responsibilities
- Physical layer protection: Microsoft secures the physical buildings, perimeter access, power, cooling, and hardware hosts.
- Infrastructure isolation: Microsoft ensures multi-tenant isolation and hypervisor security.
- Customer isolation boundary: Microsoft cannot determine which end users in your organization should have access to your internal business data.
This Answer Would Be Correct If
This option would only be true if an organization outsourced all IT operations, business administration, and data management to a fully managed third-party service provider under a comprehensive managed services contract rather than standard cloud hosting.
The customer is responsible for maintaining the physical datacenter facilities and server hardware, while Microsoft manages application configuration.
The customer is responsible for maintaining the physical datacenter facilities and server hardware, while Microsoft manages application configuration.
What Customer Facility Management Implies
This option describes an on-premises datacenter model or a traditional server colocation model where the customer owns or leases physical buildings, power systems, server racks, and cabling.
Why It Is Incorrect
This option reverses the fundamental roles of public cloud computing:
- In Microsoft Azure, Microsoft owns and manages all physical datacenters, environmental systems, physical network hardware, and physical server hosts across all cloud service models.
- The customer is never required or permitted to maintain physical servers or datacenter facilities in Azure.
- Conversely, application configuration and data settings are the customer's responsibility in cloud models like IaaS and PaaS, not Microsoft's.
Key Characteristics of Azure Infrastructure
- Microsoft-managed physical security: Includes biometric access controls, security personnel, video surveillance, and perimeter barriers.
- Hardware lifecycle management: Microsoft replaces failing drives, memory modules, and physical host processors without customer intervention.
- Customer abstraction: Cloud virtualization abstracts physical hardware so customers can focus strictly on logical resources, applications, and configurations.
This Answer Would Be Correct If
This option would be correct if describing a private, on-premises enterprise datacenter where the local organization purchases and racks its own physical hardware.
The division of responsibilities remains identical regardless of whether an organization chooses IaaS, PaaS, or SaaS.
The division of responsibilities remains identical regardless of whether an organization chooses IaaS, PaaS, or SaaS.
What a Static Responsibility Model Implies
This option suggests that moving between different cloud hosting models—such as IaaS, PaaS, and SaaS—does not alter the distribution of administrative and security tasks between the customer and Microsoft.
Why It Is Incorrect
The foundational principle of the shared responsibility model is that the division of operational duties changes significantly based on the chosen cloud service tier:
- Infrastructure as a Service (IaaS): The customer remains responsible for the operating system, middleware, runtime, and network routing/firewall rules, while Microsoft handles the physical layer and hypervisor.
- Platform as a Service (PaaS): Microsoft manages the underlying operating system, hardware, and platform patching, while the customer manages their application code and configurations.
- Software as a Service (SaaS): Microsoft provides and manages the entire application software stack, leaving the customer only to manage data, identities, and user access policies.
Key Differences Across Service Types
- Operating system maintenance: Customer-managed in IaaS; Microsoft-managed in PaaS and SaaS.
- Network controls: Fully configured by the customer in IaaS; shared or provider-managed in PaaS and SaaS.
- Application binaries: Deployed and maintained by the customer in IaaS; hosted and managed by the vendor in SaaS.
This Answer Would Be Correct If
This option would be correct if cloud computing offered only a single uniform deployment tier with fixed, unchangeable boundaries for every workload type.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Shared Responsibility Model Customer Data and Identity
Describe the shared responsibility model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Shared Responsibility Model Physical Security
Describe the shared responsibility model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
PaaS Shared Responsibility Model
Describe the shared responsibility model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Customer Data Always Retained
Describe the shared responsibility model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Shared Responsibility Model Physical Security
Describe the shared responsibility model
AdvancedAZ-104 Microsoft Azure Administrator Exam
Availability Zones High Availability
Deploy virtual machines to availability zones and availability sets
Last updated Validated