Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Provider Secures Physical Infrastructure Across All Service Models
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization is migrating its enterprise workloads to Microsoft Azure and reviewing security roles under the shared responsibility model. The security team needs to distinguish between the cloud provider's duties for "security of the cloud" and the customer's duties for "security in the cloud."
Which responsibility is managed exclusively by the cloud provider across all cloud service models?
Explanations
Applying security updates and OS patches to virtual machine guest operating systems
Applying security updates and OS patches to virtual machine guest operating systems
What Guest Operating System Patching Is
Guest operating system (OS) patching is the process of applying security updates, bug fixes, and maintenance patches to the OS running inside a virtual machine (VM).
Why It Doesn't Meet the Requirement
In an Infrastructure as a Service (IaaS) model, the customer is directly responsible for maintaining, updating, and patching the guest operating system installed on their virtual machines. While the cloud provider manages host hypervisor updates ("security of the cloud"), VM guest OS maintenance is an element of "security in the cloud" managed by the tenant.
Key Characteristics and Limitations
- Model-dependent responsibility: OS maintenance is the customer's responsibility in IaaS, but becomes the provider's responsibility in PaaS and SaaS platforms (e.g., Azure App Service or Azure SQL Database).
- Vulnerability remediation: Failing to patch guest operating systems leaves customer virtual machines vulnerable to exploits and malware.
- Automated tooling: Customers can use services like Azure Update Manager, but configuring and triggering the update process remains a customer duty in IaaS.
This Answer Would Be Correct If
The question asked which security task shifts from the customer to the cloud provider when migrating an application from IaaS to PaaS.
Additional Context
Because guest OS patching changes based on the chosen cloud service model, it is a shared or variable responsibility, not an exclusive provider responsibility across all models.
Securing physical datacenter facilities and hardware infrastructure
Securing physical datacenter facilities and hardware infrastructure
What Physical Datacenter and Hardware Security Is
Physical security and hardware infrastructure management refers to the protection and maintenance of the physical buildings, servers, network cabling, power supplies, environmental cooling systems, and biometric perimeter controls that house cloud computing resources.
How It Meets the Requirement
Under the shared responsibility model, the concept of "security of the cloud" encompasses the foundational physical infrastructure upon which all cloud services operate. Microsoft as the cloud provider assumes full, unshared responsibility for:
- Protecting physical datacenters from unauthorized physical entry, environmental hazards, and natural disasters.
- Maintaining and servicing the physical servers, blade chassis, and host compute hardware.
- Securing the physical networking infrastructure, including routers, switches, optical backbones, and cabling.
Because customers never have physical access to Azure datacenter buildings or physical host hardware, the cloud provider solely manages this layer regardless of whether the customer uses IaaS, PaaS, or SaaS.
Key Advantages and Capabilities
- Enterprise-grade perimeter defense: Datacenters use multi-layered security gates, biometric identification, 24/7 video surveillance, and security personnel.
- Environmental resilience: Redundant power feeds, uninterrupted power supplies (UPS), backup generators, and advanced climate control protect against operational failure.
- Hardware lifecycle management: Secure hardware decommissioning and disk-wiping protocols ensure decommissioned storage media cannot be compromised.
- Reduced operational burden: Customers eliminate the heavy capital expenditures and operational overhead associated with building and guarding physical facilities.
Why This Is Optimal
Entrusting physical and host infrastructure protection to the cloud provider allows organizations to focus their technical staff on securing high-level assets, such as data classification, identity governance, and application architecture.
Managing and classifying customer data stored in cloud repositories
Managing and classifying customer data stored in cloud repositories
What Data Management and Classification Is
Data management and classification involves categorizing digital assets based on sensitivity, applying encryption standards, establishing retention schedules, and defining appropriate access controls for stored information.
Why It Doesn't Meet the Requirement
Data protection represents a prime example of "security in the cloud" rather than "security of the cloud." In the shared responsibility model, the customer always retains 100% responsibility for the data stored in cloud services across all models (IaaS, PaaS, and SaaS). The cloud provider provides encryption capabilities, storage redundancy, and compliance tooling, but the customer must configure and enforce data governance.
Key Characteristics and Limitations
- Customer ownership: The cloud provider has zero insight into the sensitivity or intellectual property classification of your proprietary files.
- Access control policies: Deciding who can read, write, or export specific data sets remains entirely a customer task.
- Lifecycle enforcement: Deleting or archiving data in accordance with regulatory mandates like GDPR or HIPAA is determined and managed by the customer.
This Answer Would Be Correct If
The scenario asked for a security task that remains the sole responsibility of the customer across all cloud deployment models.
Additional Context
Treating data governance as a cloud provider task is a common security misconception; providers supply secure storage mechanisms, but customers own the data stored within them.
Configuring user identity and access management policies
Configuring user identity and access management policies
What Identity and Access Management (IAM) Is
Identity and access management (IAM) refers to the framework of policies, processes, and technologies—such as Microsoft Entra ID—used to authenticate individuals, enforce multi-factor authentication (MFA), and grant role-based authorizations to resources.
Why It Doesn't Meet the Requirement
Identity management is a fundamental component of "security in the cloud." The customer is always accountable for managing user accounts, setting password policies, assigning roles, and revoking credentials when employees leave the organization. The cloud provider delivers the identity platform and infrastructure reliability, but does not control customer access rights or account configurations.
Key Characteristics and Limitations
- Credential governance: The customer decides which users are granted access to subscriptions, resource groups, and applications.
- Authentication settings: Enforcing conditional access policies, single sign-on (SSO), and phishing-resistant MFA is configured by customer administrators.
- Zero Trust alignment: Identity is the modern security perimeter, making customer-driven access control critical for preventing unauthorized data access.
This Answer Would Be Correct If
The scenario asked to identify an operational security domain where the customer must maintain governance across IaaS, PaaS, and SaaS environments.
Additional Context
Even in SaaS solutions like Microsoft 365, customer administrators must configure user permissions and identity security; the provider does not manage tenant directory assignments on the customer's behalf.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Shared Responsibility Model Customer Data and Identity
Describe the shared responsibility model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Shared Responsibility Model Physical Security
Describe the shared responsibility model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
PaaS Shared Responsibility Model
Describe the shared responsibility model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Shared Responsibility Model Customer-Only Responsibilities
Describe the shared responsibility model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Shared Responsibility Model
Describe the shared responsibility model
AdvancedAZ-104 Microsoft Azure Administrator Exam
Availability Zones High Availability
Deploy virtual machines to availability zones and availability sets
Last updated Validated