Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Customer Control of Entra ID and Data Governance
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization is evaluating its migration strategy to Microsoft Azure and reviewing how operational and security responsibilities change across different cloud service types.
The IT leadership team needs to ensure governance, data protection, and user access policies remain compliant across all adopted services, whether using Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or Software as a Service (SaaS).
Under the shared responsibility model, which responsibility is always retained entirely by the customer regardless of the cloud service model chosen?
Explanations
Managing user identities, access permissions, and data governance
Managing user identities, access permissions, and data governance
What Identity and Data Governance Entails
Identity and access management (IAM) and data governance encompass the policies, tools, and processes used to secure data, authenticate users, and authorize access to cloud resources. In Microsoft Azure, identity is centralized using Microsoft Entra ID and governed via Azure role-based access control (Azure RBAC).
How It Meets the Shared Responsibility Requirement
Under the shared responsibility model, certain operational and security duties remain 100% the customer's responsibility across every cloud delivery model:
- Information and data: The customer always owns the classification, encryption, and protection of business data.
- Identities and credentials: Managing user accounts, assigning roles, enabling multi-factor authentication, and establishing conditional access policies are always customer obligations.
- Devices and endpoints: Securing client endpoints that connect to cloud services is managed entirely by the customer.
Whether utilizing IaaS, PaaS, or SaaS, Microsoft provides the tools to manage access and protect data, but configuring, assigning, and enforcing access rules remains the customer's exclusive duty.
Key Advantages and Capabilities
- Consistent governance: Centralizing identities in a single tenant ensures unified governance across all subscriptions and services.
- Granular authorization: Using Azure RBAC allows organizations to apply least-privilege permissions across management groups, subscriptions, and resource groups.
- Data sovereignty: Customers retain complete control and ownership over where their data resides and who can access it.
- Protection against unauthorized access: Strict identity controls safeguard resources even if underlying services vary.
Why This Is Optimal
Cloud providers manage underlying physical assets and infrastructure, but they cannot determine which specific employees or systems inside an enterprise require access to corporate data. Retaining full customer accountability for identity and data ensures business-level security policies are maintained across IaaS, PaaS, and SaaS deployments.
Operating system installation, patching, and configuration
Operating system installation, patching, and configuration
What Operating System Management Is
Operating system (OS) management involves installing the base operating system, applying security updates, deploying hotfixes, and configuring system-level services and kernels.
Why It Doesn't Meet the Requirement
Operating system maintenance does not remain with the customer across all cloud models. Its allocation shifts significantly depending on the service tier:
- In Infrastructure as a Service (IaaS), the customer is fully responsible for installing, configuring, and patching the guest operating system on virtual machines.
- In Platform as a Service (PaaS) and Software as a Service (SaaS), Microsoft handles operating system deployment, patching, updates, and maintenance automatically.
Because this responsibility transfers to the cloud provider in PaaS and SaaS environments, it is not retained by the customer across all models.
Key Characteristics and Limitations
- IaaS requirement: The customer controls and manages OS configurations and update schedules.
- PaaS abstraction: The underlying OS is managed and updated by Azure without customer intervention.
- SaaS abstraction: The OS is completely transparent to end users and managed end-to-end by the service provider.
This Answer Would Be Correct If
The scenario specifically asked for an administrative task that is managed by the customer exclusively when deploying virtual machines in an Infrastructure as a Service (IaaS) model.
Additional Context
Confusing IaaS operational tasks with universal responsibilities is common. While IaaS grants deep operating system control, PaaS and SaaS abstract the OS layer away to reduce maintenance overhead.
Physical data center security, hardware replacement, and power management
Physical data center security, hardware replacement, and power management
What Physical Infrastructure Management Is
Physical infrastructure management covers the physical security of data center buildings, hardware provisioning, rack installations, uninterrupted power supplies (UPS), cooling infrastructure, and physical network cabling.
Why It Doesn't Meet the Requirement
In public cloud environments like Microsoft Azure, the physical security of data centers and hardware maintenance is never the responsibility of the customer. Microsoft assumes complete responsibility for:
- Guarding and securing physical data center facilities.
- Replacing damaged disks, memory modules, and physical servers.
- Managing cooling, environmental controls, and redundant electrical grids.
Because physical security is managed entirely by Microsoft across IaaS, PaaS, and SaaS, it is not a customer responsibility.
Key Characteristics and Limitations
- Cloud provider responsibility: Microsoft manages and guarantees physical data center security across all public cloud services.
- Shared compliance: Azure provides physical infrastructure compliance certifications (such as ISO 27001 and SOC 2) that customers can leverage.
- Zero customer physical access: Customers do not have physical access to Azure facilities or servers.
This Answer Would Be Correct If
The question asked which security and operational layer is always handled by the cloud provider regardless of the cloud model chosen.
Additional Context
Physical security is only the customer's duty when operating an on-premises private data center. Once workloads migrate to public cloud models, physical maintenance completely shifts to the cloud provider.
Runtime environment provisioning and middleware updates
Runtime environment provisioning and middleware updates
What Runtime and Middleware Management Is
Runtime and middleware management includes managing execution frameworks (such as .NET, Java, Node.js, or Python runtimes), database engines, web server software, and messaging queues that host application code.
Why It Doesn't Meet the Requirement
The responsibility for runtime environments and middleware shifts depending on the cloud architecture:
- In IaaS, the customer must install, patch, and manage the runtime stacks and middleware frameworks on their virtual machines.
- In PaaS (such as Azure App Service or Azure SQL Database), Microsoft automatically provisions, patches, and manages the execution runtime and database engines.
- In SaaS, the provider manages the entire application stack including all middleware.
Because runtime and middleware tasks are offloaded to Microsoft in PaaS and SaaS, they are not retained by the customer across all tiers.
Key Characteristics and Limitations
- Service-dependent allocation: Middleware management is a primary dividing line between IaaS and PaaS.
- Automated framework patching: PaaS offerings relieve developers from manually upgrading runtimes and security libraries.
- Focus on business logic: PaaS allows customers to focus purely on application code and data while Azure handles runtime availability.
This Answer Would Be Correct If
The question asked which component customers are responsible for managing in an IaaS model that becomes Microsoft's responsibility when transitioning to a PaaS model.
Additional Context
A primary motivation for organizations moving from IaaS to PaaS is eliminating the operational burden of managing middleware, web server engines, and runtime frameworks.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Shared Responsibility Model Physical Security
Describe the shared responsibility model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
PaaS Shared Responsibility Model
Describe the shared responsibility model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Shared Responsibility Model
Describe the shared responsibility model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Shared Responsibility Model IaaS
Describe the shared responsibility model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Shared Responsibility Model Customer Data and Identity
Describe the shared responsibility model
IntermediateAZ-800 Administering Windows Server Hybrid Core Infrastructure Exam
Azure File Sync Event Logs and Azure Monitor
Configure and manage Azure File Sync
Last updated Validated