Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Data Protection and Identity Access Remain Customer Responsibilities
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An enterprise is planning to deploy several business workloads to Microsoft Azure using a combination of Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS).
The Chief Information Security Officer (CISO) wants to establish clear operational boundaries and ensure that the internal team knows which security duties will never transfer to the cloud provider.
Which responsibility is always retained entirely by the customer regardless of the cloud service model selected?
Explanations
Protecting customer data and managing user identities and access
Protecting customer data and managing user identities and access
What Customer Data and Identity Management Is
In cloud computing, data protection and identity and access management (IAM) encompass the practices, tools, and policies used to safeguard digital assets, establish user accounts, enforce authentication, and control authorization to cloud resources.
How It Meets the Scenario Requirements
Under the shared responsibility model, specific security responsibilities remain with the customer across every cloud model—whether deploying Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or Software as a Service (SaaS):
- Customer data: The customer retains full ownership and accountability for classifying data, applying encryption, configuring retention policies, and meeting regulatory compliance requirements.
- Identities and users: The customer is exclusively responsible for provisioning user credentials, enforcing multi-factor authentication (MFA), and configuring role-based access control (RBAC).
Key Advantages and Capabilities
- Universal control: Retaining control of identities and data allows organizations to govern access consistently across hybrid and multi-cloud environments.
- Zero Trust alignment: Organizations can implement conditional access, session monitoring, and least-privilege permissions tailored to their compliance needs.
- Data sovereignty: Customers decide where their information resides and how it is secured, encrypted, and backed up.
- Governance enforcement: Companies can enforce organization-wide security baselines without relying on third-party default access policies.
Why This Responsibility Is Always Retained
While cloud providers manage the physical infrastructure and underlying hardware, they have no visibility into the sensitivity of the files stored or who in your organization should have administrative rights. As a result, information and data governance along with identity management are universally retained customer responsibilities.
Securing physical datacenter facilities and server hardware
Securing physical datacenter facilities and server hardware
What Physical Datacenter Security Is
Physical security encompasses the physical protection of buildings, biometric access gates, security guards, perimeter surveillance, environmental controls, and the hardware servers that power cloud services.
Why It Doesn't Meet the Requirement
In public cloud computing, physical security is never the customer's responsibility. The cloud provider (Microsoft) handles 100% of physical datacenter facilities, power systems, server hardware, and physical network infrastructure across IaaS, PaaS, and SaaS.
Key Characteristics and Limitations
- Provider-managed: Microsoft secures all physical buildings, cages, racks, and host hardware.
- Zero customer access: Public cloud customers do not have physical access to the datacenters or host servers hosting their workloads.
- Compliance certifications: Cloud providers undergo independent third-party audits (such as ISO/IEC 27001 and SOC reports) to prove physical facility compliance.
This Answer Would Be Correct If
The question described a private, on-premises datacenter where the organization owns and operates its own physical facilities and server racks.
Additional Context
One of the fundamental advantages of cloud computing is relieving the customer from the cost and burden of securing physical infrastructure.
Patching and maintaining operating system software
Patching and maintaining operating system software
What Operating System Patching Is
Operating system (OS) management involves installing system updates, applying critical security patches, configuring OS-level firewalls, and managing underlying system services on virtual or physical hosts.
Why It Doesn't Meet the Requirement
Operating system maintenance is not a customer responsibility across all cloud models:
- In IaaS, the customer manages and patches the OS on virtual machines.
- In PaaS (e.g., Azure App Service, Azure SQL Database) and SaaS (e.g., Microsoft 365), the cloud provider completely abstracts and manages OS patching and maintenance.
Key Characteristics and Limitations
- Service-model dependent: OS maintenance shifts directly from the customer to Microsoft when migrating from IaaS to PaaS or SaaS.
- Platform abstraction: PaaS platforms automatically apply runtime and OS updates without customer intervention.
- Administrative overhead: Managing the OS is one of the key maintenance tasks organizations aim to eliminate when adopting managed services.
This Answer Would Be Correct If
The scenario asked which maintenance task remains a customer responsibility strictly within the Infrastructure as a Service (IaaS) service model.
Additional Context
Choosing PaaS over IaaS is primarily motivated by offloading repetitive tasks like operating system maintenance to the cloud provider.
Configuring the virtualization layer and hypervisors
Configuring the virtualization layer and hypervisors
What Hypervisor Configuration Is
The hypervisor (virtualization layer) is the software or firmware that provisions, isolates, and manages virtual machines on physical host hardware.
Why It Doesn't Meet the Requirement
In the public cloud, configuring and maintaining the hypervisor is always the responsibility of the cloud provider. Microsoft manages the virtualization platform across all cloud service models (IaaS, PaaS, and SaaS) to ensure workload isolation and underlying compute availability.
Key Characteristics and Limitations
- Hypervisor isolation: The cloud provider ensures logical separation between different tenant workloads sharing the same hardware.
- Infrastructure abstraction: Customers cannot configure, patch, or access the underlying hypervisor.
- Unified provider control: Microsoft maintains hypervisor integrity and deploys hypervisor-level security updates transparently.
This Answer Would Be Correct If
The organization were managing an on-premises virtualization cluster (such as local Hyper-V or VMware hosts) within their private datacenter.
Additional Context
In IaaS, the customer's management boundary begins at the guest operating system inside the virtual machine, not at the hypervisor layer.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Shared Responsibility Model Physical Security
Describe the shared responsibility model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
PaaS Shared Responsibility Model
Describe the shared responsibility model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Customer Data Always Retained
Describe the shared responsibility model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Shared Responsibility Model IaaS
Describe the shared responsibility model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Shared Responsibility Model Customer-Only Responsibilities
Describe the shared responsibility model
AdvancedAZ-104 Microsoft Azure Administrator Exam
Availability Zones High Availability
Deploy virtual machines to availability zones and availability sets
Last updated Validated