Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Microsoft Physical Security Across All Cloud Models
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An enterprise is planning to migrate several workloads to Microsoft Azure across Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) models. The leadership team wants to establish clear operational boundaries between internal IT staff and the cloud provider.
Under the shared responsibility model, which security responsibility is always managed entirely by Microsoft across all cloud service models?
Explanations
User account provisioning and identity access management
User account provisioning and identity access management
What Identity and Access Management Is
Identity and Access Management (IAM) involves the creation, administration, and governance of digital identities (user accounts, service principals, and groups), along with defining the specific permissions, roles, and access controls that dictate what resources those identities can access.
Why It Doesn't Meet the Requirement
Identity and access management is a responsibility that always remains with the customer across all cloud deployment models, rather than being managed by Microsoft. Whether utilizing IaaS, PaaS, SaaS, or on-premises systems, customers must determine who has access to their systems and data.
Key Characteristics and Limitations
- Customer Ownership: The customer owns and controls identity lifecycle management, such as provisioning employee accounts and assigning role-based access control (RBAC).
- Authentication Policies: Implementing security policies, such as Multifactor Authentication (MFA) and conditional access rules, is the direct duty of the customer's administrators.
- Provider Boundary: While Microsoft provides identity platform tools (such as Microsoft Entra ID), Microsoft does not administer or determine access rights for customer accounts.
This Answer Would Be Correct If
The question asked which security and administrative responsibility is always retained by the customer regardless of the cloud service model deployed.
Additional Context
A core tenet of cloud security is that data and identities always belong to the customer. Cloud providers deliver the identity infrastructure, but customers must configure, assign, and protect access permissions.
Physical datacenter security and host hardware maintenance
Physical datacenter security and host hardware maintenance
What Provider Physical Security and Host Maintenance Is
Physical security and host infrastructure maintenance encompass the protection and operational management of the underlying physical assets that power cloud computing. This includes securing the physical datacenters, managing facility access controls, providing environmental safeguards (such as power redundancy and cooling), and maintaining physical servers, hypervisors, and physical network cabling and switches.
How It Meets the Requirement
In the shared responsibility model, responsibilities are divided between the customer and the cloud provider based on the chosen deployment model. However, physical infrastructure is the one foundational layer where responsibility never shifts to the customer:
- IaaS deployments: Microsoft manages datacenter access, physical host hardware, and the underlying hypervisor, while the customer manages operating systems and applications.
- PaaS deployments: Microsoft manages the physical layers along with operating system patching, while the customer manages application logic and data.
- SaaS deployments: Microsoft manages the entire underlying hardware, platform, and application infrastructure.
Key Advantages and Provider Responsibilities
- Physical Datacenter Security: Microsoft implements multi-layered physical security controls, including perimeter fencing, biometric authentication, security personnel, and video surveillance.
- Hardware Lifecycle Management: Azure handles replacing faulty disks, updating server components, and decommissioning hardware securely.
- Environmental Resilience: Datacenters feature redundant power supplies, backup generators, and climate control to ensure maximum uptime.
- Physical Network Infrastructure: Managing fiber lines, top-of-rack switches, and core routing equipment is entirely handled by Azure engineers.
Why This Is Optimal
Transferring physical infrastructure management to Azure allows organizations to eliminate capital expenditures associated with constructing datacenters, purchasing server hardware, and hiring on-site security guards. Regardless of whether an organization adopts IaaS, PaaS, or SaaS, the security of the cloud foundation remains completely in Microsoft's hands.
Operating system updates and security patch management
Operating system updates and security patch management
What Operating System Management Is
Operating system (OS) management involves installing, configuring, hardening, and regularly patching the core software environment running on a server or virtual machine to protect against vulnerabilities and ensure stable execution of applications.
Why It Doesn't Meet the Requirement
Operating system management is not exclusively managed by Microsoft across all service models. The level of responsibility depends on the specific cloud service model being utilized:
- In Infrastructure as a Service (IaaS), the customer provisions the virtual machine and is fully responsible for selecting, updating, and patching the operating system.
- In Platform as a Service (PaaS) and Software as a Service (SaaS), Microsoft takes over the underlying operating system maintenance.
Key Characteristics and Limitations
- Variable Responsibility: Because responsibility for the operating system transfers based on the service model, it cannot be categorized as a provider-only responsibility across all deployments.
- IaaS Control: In IaaS, customers maintain full administrative control over the OS, which requires them to schedule maintenance windows and deploy security patches.
- PaaS Abstraction: In PaaS (such as Azure App Service), the OS is managed by Azure, relieving customers of routine maintenance.
This Answer Would Be Correct If
The scenario specifically asked which responsibility transfers from the customer to Microsoft when transitioning from an Infrastructure as a Service (IaaS) model to a Platform as a Service (PaaS) model.
Additional Context
Confusing IaaS OS management with PaaS OS management is a common misconception. In IaaS, virtual machines function like traditional servers where the customer retains OS-level administrative rights and patching duties.
Customer data classification and encryption policy configuration
Customer data classification and encryption policy configuration
What Data Governance and Encryption Configuration Is
Data governance, classification, and encryption configuration involve identifying the sensitivity of corporate information, tagging assets according to regulatory needs, and applying appropriate encryption keys and protection mechanisms for data both in transit and at rest.
Why It Doesn't Meet the Requirement
Under the shared responsibility model, customer data is always the sole responsibility of the customer. Microsoft does not inspect, classify, or make governance decisions regarding the data stored by organizations within Azure services.
Key Characteristics and Limitations
- Customer Ownership: Microsoft explicitly does not claim ownership or control over the data uploaded or processed within customer subscriptions.
- Classification Obligations: Customers must classify their sensitive records, define data retention schedules, and apply encryption policies appropriate for their regulatory requirements.
- Tooling vs. Execution: Microsoft offers security tools and encryption technologies (such as Azure Key Vault and storage service encryption), but configuring and enforcing policies remains a customer obligation.
This Answer Would Be Correct If
The scenario inquired about an area where the customer maintains 100% accountability across on-premises, IaaS, PaaS, and SaaS environments.
Additional Context
Cloud providers follow a zero-access model regarding customer content. Microsoft does not monitor or categorize customer data, making data governance an unvarying customer responsibility across every cloud delivery architecture.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
PaaS Shared Responsibility Model
Describe the shared responsibility model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Shared Responsibility Model
Describe the shared responsibility model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Customer Data Always Retained
Describe the shared responsibility model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Shared Responsibility Model Customer-Only Responsibilities
Describe the shared responsibility model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
PaaS Shared Responsibility Model
Describe the shared responsibility model
IntermediateAZ-800 Administering Windows Server Hybrid Core Infrastructure Exam
Azure File Sync Event Logs and Azure Monitor
Configure and manage Azure File Sync
Last updated Validated