Cloud Concepts, Service Models and Deployment Models

Review questions

Integrated Subject 1 Summary: From Cloud Definition to Responsibility Boundaries

Cloud computing begins with how computing resources are consumed and managed, not with where a server is located. The NIST model gives us five connected characteristics for testing a description: on-demand self-service, broad network access, resource pooling, rapid elasticity and measured service. A server can be remote yet remain fixed for an annual contract, with every change requiring a manual ticket. In that case, remoteness or virtualization alone does not prove a complete cloud model. We need evidence about provisioning, change and measurement. The value of the characteristics also depends on the need. A seasonal workload may benefit from elasticity, while a stable workload with strict performance requirements needs a broader comparison. Cloud is not an automatic promise of lower cost or higher security.

The three service models describe what capability is delivered. IaaS supplies foundational infrastructure on which the customer can operate a guest OS and applications, providing deeper control with greater operating responsibility. PaaS moves more of the operating system and platform layers to the provider, allowing the customer to focus on application code, data and configuration. SaaS provides a ready-made application, so the customer does not operate the servers, OS or core application code. Moving up the managed stack does not remove customer responsibility for data, identities, permissions and available configuration. The practical question is therefore how much control the workload requires and which layers the organization has the skill and desire to operate.

Deployment models are a different axis. Public cloud means the infrastructure is offered for general consumer use; it does not mean every customer’s data is public. Private cloud is reserved for one organization and may be on premises or off premises and operated by a third party. Community cloud is reserved for a community of organizations with shared concerns or requirements. Hybrid cloud combines distinct cloud environments that remain separate but are bound to enable movement of data or applications. Merely using two providers is not enough to make a design hybrid; there must be distinct cloud environments connected for an operating purpose. Likewise, “private” is not a synonym for “secure,” and “public” is not a synonym for “exposed data.” Actual controls determine protection.

Shared responsibility connects these concepts to operations. In IaaS, the provider runs the data center, hardware and underlying infrastructure, while the customer typically operates the guest OS, applications and what it deploys above that boundary. In PaaS, the OS and platform shift further to the provider, while the customer remains responsible for its code, data and access within its control. In SaaS, the provider operates the core application and supporting stack, but the customer’s accounts, permissions, data and available settings still require customer decisions. Shared responsibility therefore does not mean every task is divided equally. It is a map of who controls each layer and decision.

For practice, use four steps. First, describe the requirement: variable or stable demand, ready-made or custom application, and relevant data, security and performance needs. Second, select a candidate service model according to required control and acceptable operating burden. Third, keep the deployment-model decision separate from the service-model decision and identify who uses the environment and how distinct clouds would be connected. Fourth, create a responsibility matrix: who patches the OS, who manages identity, who protects data, and who tests backup and recovery? Do not treat the existence of a feature such as MFA or backup as proof that a control is implemented. Verify that it is configured, monitored, tested and clearly owned. This turns cloud terminology from labels to operational questions that support explainable decisions.

Review questions

Test your understanding with these questions. Marking and saved results are available with a free account.

Question 1Which situation is the strongest evidence of on-demand self-service? Emailing the provider and waiting three days for an employee to add a server. Using the service portal to create an available resource within account limits without provider staff acting on each request. Paying a fixed annual bill for a server whose capacity does not change. Accessing an application through the internet.
Question 2An application rises from 2,000 to 20,000 concurrent users for two days and then returns to normal. Which cloud characteristic directly addresses that pattern if the service is designed to change capacity quickly? Broad network access Resource pooling Rapid elasticity Measured service
Question 3Which example most accurately represents measured service? The service reports storage and compute consumption for the period and associates it with the resources used. The data center is in a different city from the user. The organization uses a virtual machine instead of a physical machine. The user can access the application from a phone.
Question 4A service description says: “a remote virtual server, fixed capacity for a full year, and every increase requires a manual ticket that takes a week.” What is the most disciplined conclusion? It must be cloud because the server is virtual. It must be cloud because the server is remote. The information does not demonstrate the full cloud characteristics; we need evidence about self-service, elasticity, measurement and pooling. It is not a technical service because it does not auto-scale.
Question 5A team wants a ready-made collaboration application and does not want to develop the application or operate its OS. Which service model is the closest fit? IaaS PaaS Private cloud by necessity SaaS
Question 6A team has custom web-application code and wants to deploy it without managing the underlying operating system. Which model is the closest initial candidate? SaaS PaaS IaaS Community cloud
Question 7In a typical IaaS case, which task remains closest to customer responsibility? Maintaining the provider’s physical data-center building Replacing a disk in the provider’s physical server Updating the guest operating system managed by the customer Operating power and cooling in the provider data center
Question 8An application initially fit PaaS, but a new requirement appears: a special operating-system driver must be installed and the platform does not allow it. What is the logical change in the decision? Keep PaaS because every platform allows OS modification. Move to SaaS because SaaS gives more OS control. Re-evaluate IaaS because it gives the customer more control of the guest OS. Change only the deployment model and do not revisit the service model.
Question 9A cloud environment is reserved exclusively for one organization, but it is off premises and operated by a third party. Which deployment model is the closest fit? Public Private Community Automatically hybrid
Question 10Several universities share defined research and security requirements and use a cloud environment reserved for that community. What is the deployment model? Public Private for a single organization Community SaaS
Question 11An organization binds a private cloud to a public cloud so that part of an application and defined data can move according to policy. Which model is the closest fit? Hybrid Public only Private only Community
Question 12Which statement about public cloud is the most accurate? It means all customer data is visible to the public. It means the cloud infrastructure is offered for general use; it does not mean each customer’s data is public. It means the customer needs no access controls. It means the service is always SaaS.
Question 13An application runs on IaaS and the customer manages the guest OS. A vulnerability requires an OS update. Who has the closest initial responsibility for applying the update? The customer that manages the guest operating system The provider because it owns the data center The end user of the application Nobody because the service is cloud-based
Question 14An organization uses a ready-made SaaS application. Which responsibility most clearly remains with the customer? Replacing a physical disk in the provider’s server Patching the OS that runs the provider’s SaaS service Reviewing the organization’s user accounts, permissions and the data they share Operating data-center cooling
Question 15What is the most accurate meaning of “shared responsibility”? Every task is split 50/50 between customer and provider. Responsibilities are distributed by layer and control; some belong to the provider, some to the customer and some require coordination. The provider is responsible for everything because the service is paid. The customer is responsible for everything because the data belongs to it.
Question 16A SaaS service supports multi-factor authentication, but the organization has not enabled it for the required accounts. What is the correct conclusion? The control is implemented because the product has the feature. Only the provider is responsible for enabling it for every customer. Feature availability does not prove control implementation; the customer must verify and configure it within its responsibility. Authentication is unrelated to shared responsibility.