1.1 - Cloud models and shared responsibility
AZ-900 objective 1.1 covers cloud computing fundamentals: the deployment models and where responsibility sits. You separate public, private and hybrid clouds - a hybrid cloud connects on-premises datacenters to Azure so not-yet-depreciated hardware keeps running while new workloads move to the cloud, and cloud bursting overflows to Azure only during seasonal demand spikes, then pulls back. Data sovereignty means placing resources in a cloud region physically inside a country's borders so citizen data never leaves. The shared responsibility model splits duties by service type: in IaaS the customer patches the guest operating system, while in PaaS and SaaS Microsoft maintains the OS and runtime and the customer always keeps its own data, accounts and identities. Shifting from a capital-expenditure to an operating-expenditure model avoids buying and depreciating hardware you may never fully use, and lets you pay for capacity as you consume it. Expect scenarios that describe a mixed environment or a patching duty and ask which cloud model or responsibility applies.
On-premises hardware connected to Azure = hybrid cloud; overflow only at peaks = cloud bursting. In IaaS the customer patches the OS; in PaaS/SaaS Microsoft does. Data must stay in the country = pick a region inside its borders.
Practice questions
1. A company keeps sensitive workloads in its own datacenter but runs its public website in Azure, with the two environments connected. Which cloud model is this?
- A community cloud shared with partner organizations in the same industry
- A hybrid cloud (correct answer)
- A fully public cloud hosted by a single provider for all workloads
- A private cloud running entirely on company-owned hardware
A hybrid cloud combines a private environment (the company datacenter) with public cloud services (the Azure-hosted website) and connects them. A public cloud alone would host everything at the provider, a private cloud alone would keep everything on premises, and a community cloud serves a group of organizations, which is not described here.
2. A development team deploys web apps to a managed platform where Microsoft handles the OS, patching, and runtime, and the team only manages its code and data. Which service model is this?
- Infrastructure as a service (IaaS)
- Platform as a service (PaaS) (correct answer)
- Software as a service (SaaS) with custom extensions
- A dedicated private hosting model with managed hardware
PaaS provides a managed platform: the provider runs the OS, middleware, and runtime while the customer manages only applications and data - exactly what Azure App Service offers. IaaS would leave the OS to the team, SaaS would deliver a finished application with no code to deploy, and dedicated hosting is not a cloud service model.
3. Under the shared responsibility model, which task remains the customer's responsibility in EVERY service model, including SaaS?
- Patching the physical host servers inside the Microsoft datacenter
- Securing the data and the accounts and devices that access it (correct answer)
- Maintaining the physical network hardware that interconnects the region
- Replacing failed disks and power supplies in the storage clusters
In the shared responsibility model, information and data, devices, and accounts and identities ALWAYS remain the customer's responsibility, even in SaaS. Physical hosts, network hardware, and datacenter components are always Microsoft's responsibility in the cloud.
4. A government agency needs cloud-style self-service and automation, but regulations require all hardware to be dedicated to the agency and hosted in its own facility. Which model meets this?
- A public cloud tenant isolated only by logical controls and encryption
- A private cloud (correct answer)
- A hybrid cloud bursting sensitive workloads to a public provider
- A multi-tenant SaaS platform certified for government workloads
A private cloud delivers cloud capabilities (self-service, automation, pooled resources) on hardware dedicated to a single organization, which can be hosted in its own facility. A public tenant shares physical hardware, hybrid bursting would push sensitive workloads outside, and multi-tenant SaaS shares the platform by design.
5. A hospital must keep patient records in its own datacenter for legal reasons but wants to run its public appointment portal in the cloud, linking the two. Which model fits?
- A public cloud where the patient records are also stored at the provider
- A hybrid cloud (correct answer)
- A private cloud that runs every workload on hospital-owned hardware
- A community cloud shared with other regional hospitals and clinics
A hybrid cloud keeps the regulated records in the owned datacenter while running the public portal in the cloud and connecting the two. A public cloud would move the records off site, a private cloud would keep everything on premises with no cloud portal, and a community cloud serves a group with shared requirements, which is not described.
6. A defense contractor's rules forbid any workload from leaving its premises, yet it wants pooled resources and self-service provisioning for its internal teams. Which model?
- A public cloud region reserved for government tenants only
- A private cloud (correct answer)
- A hybrid cloud that keeps only the classified data on site
- A community cloud operated jointly with other defense contractors
A private cloud delivers pooled resources and self-service on hardware dedicated to one organization inside its own facility, so nothing leaves the premises. A public region still hosts data at the provider, a hybrid model deliberately sends some workloads outside, and a community cloud is shared across organizations.