T01 · C10 — Cloud Service and Deployment Models

1. Why this topic matters here

This is the single best-value topic on the entire paper — ROI 1.258, the highest of all 43 subtopics analysed. It carries an expected 1.51 questions and takes about 1.2 hours to learn cold. Five items in the recent-cycle corpus test it directly (SaaS use case, IaaS selection, private cloud, cloud migration, scalability-driven model choice), a candidate named cloud model selection unprompted, and every aggregator syllabus lists it. Nothing else on this paper converts study time into marks this efficiently.

It also anchors Section C. Cloud is 31% of the paper when combined with networking and security, and the service/deployment model distinction is the vocabulary that the harder cloud questions (C11 containers, C12 characteristics) assume you already have.

2. Exactly what gets asked

The evidence shows four recurring question shapes:

1. Scenario → pick the service model. "A company wants to deploy a web application without managing the operating system or runtime. Which model?" You are given a business need and must map it to IaaS / PaaS / SaaS. This is the most common shape.

1. (a) IaaS. Control of OS, runtime and networking without owning hardware is the definition of IaaS.

• (b) SaaS wrong — you get a finished application, no OS access at all.
• (c) PaaS wrong — the provider manages the OS; that is precisely what this customer wants to control.
• (d) FaaS wrong — you deploy functions, with no OS visibility whatsoever.

2. Scenario → pick the deployment model. Usually keyed on a compliance or data-residency constraint ("sensitive patient records must not leave the organisation's own datacentre") or a bursting need ("steady baseline with seasonal spikes" → hybrid).

2. (d) Microsoft 365. A finished application suite accessed over the internet.

• (a) EC2 and (b) Azure Virtual Machines are IaaS — raw virtual machines.
• (c) Google App Engine is PaaS — you deploy code, not a finished product.

3. Responsibility boundary. "In a PaaS deployment, who is responsible for patching the operating system?" Tests whether you know the boundary moves between models.

3. (b) The application code and its data. PaaS gives you a managed platform; what you put on it stays yours.

• (a) and (c) are the provider's job in PaaS — that is the value proposition.
• (d) is always the provider's, in every cloud model.

4. Named-service identification. "Which AWS service is an example of IaaS?" Requires knowing that EC2 is IaaS, Lambda is FaaS/serverless, S3 is storage-as-a-service.

A fifth, rarer shape asks you to rank models by customer control (IaaS most, SaaS least) or to spot which characteristic does not belong to cloud computing.

3. Concept notes

3.1 What cloud computing actually means

Traditionally, to run an application you bought and housed a physical server: you paid capital cost up front, sized it for peak load, waited weeks for delivery, patched the OS yourself, and replaced it every few years. Cloud computing replaces that with renting capacity on demand from someone else's data centre, paying only for what you use, and letting the provider own the hardware.

Three consequences matter for exams:

NIST's five essential characteristics (commonly asked as "which is NOT a cloud characteristic"): on-demand self-service, broad network access, resource pooling (multi-tenancy), rapid elasticity, measured service (pay-per-use metering). Elasticity = automatically scaling down as well as up; scalability alone only means handling growth.

3.2 The pizza analogy, mapped properly

The analogy is useful only if each pizza step is mapped to a real IT layer. You are hosting dinner.

Read the table downwards: as you go IaaS → PaaS → SaaS, more rows move to the provider. The last row never moves. That is the whole point of the analogy and the whole point of the shared responsibility model below.

3.3 The stack layers (bottom → top)

1. Networking — physical links, switches, routing, firewalls, load balancing.
2. Storage — block/disk volumes, object storage, file shares.
3. Servers — physical CPU, RAM, hosts.
4. Virtualisation — the hypervisor that slices physical servers into VMs.

4. (a) Community cloud. Several organisations, one shared environment, a common regulatory concern, closed to the public. That is the textbook definition.

• (d) Public wrong — it is not open to the general public.
• (b) Private wrong — private means a single organisation.
• (c) Hybrid wrong — hybrid is one organisation combining cloud types, not several organisations sharing one.

5. OS — the guest operating system (Linux, Windows).

5. (b) Hybrid cloud. One organisation, a private component and a public component, with data portability between them.

• (a) Private wrong — only half the description.
• (c) Community wrong — needs several organisations with a shared concern.
• (d) Multi-cloud is the closest distractor but means using several public providers; it does not imply a private component.

6. Middleware — web servers, message queues, app servers, integration glue.

6. (d) IaaS → PaaS → SaaS. Control decreases as the provider takes over more layers; convenience moves in the opposite direction.

• The other orderings invert or scramble the stack.

7. Runtime — the language runtime/execution environment (JVM, Python interpreter, container runtime).

7. (b) User access management and data. The always-yours rule: no provider takes responsibility for who you hand a password to, or for the content you upload.

• (a), (c) and (d) are all provider responsibilities in SaaS.

8. Data — your records, files, objects, and who may access them.

8. (a) FaaS. Event-driven, per-invocation billing, no persistent server is the definition of Function as a Service / serverless.

• (b) IaaS wrong — there is no server to manage.
• (c) SaaS wrong — you are writing the code, not consuming an application.
• (d) is a deployment model, not a service model — a category error the question is testing.

9. Application — the code that delivers the business function.

3.4 Provider vs customer by service model (the key table)

Notes:

• In IaaS the provider runs the physical network, but virtual network configuration (subnets, security groups, routing) is normally the customer's job.
• In SaaS the provider runs the application, but the content of the data and who may reach it remain the customer's responsibility. Data ownership never transfers to the provider.
• Rule of thumb: you patch the OS → IaaS. You only deploy code → PaaS. You only log in and use it → SaaS.

3.5 Examples

3.6 FaaS / serverless

FaaS (Function-as-a-Service) sits above PaaS in abstraction: the provider manages everything PaaS manages plus the application's execution environment, and there is no long-lived server or instance you can log into. You upload a function; it runs when triggered by an event (HTTP request, file upload, queue message, schedule), scales to zero when idle, and you are billed per invocation and per execution time.

Why it is called a PaaS subtype: from the customer's view the obligations are PaaS-shaped — you supply only code plus configuration, all OS/runtime/middleware patching is the provider's. What makes it a distinct point on the spectrum is event-driven execution, ephemeral instances, scale-to-zero, and per-invocation billing. You still own your code, your data, your IAM permissions, and your function configuration (timeouts, memory, environment variables, secrets) — so the "always yours" rule below still applies.

Examples: AWS Lambda, Azure Functions, Google Cloud Functions.

3.7 Deployment models

Two distinctions worth remembering:

• Public vs private is about provisioning and tenancy, not physical location. A private cloud can be hosted in a provider's data centre (dedicated hardware), and an on-premises data centre is not automatically a private cloud.
• Hybrid ≠ multi-cloud. Hybrid combines public with private. Multi-cloud means using more than one public provider (AWS and Azure), and can be entirely public.

3.8 Shared responsibility model

How the boundary moves:

Non-negotiable rule: the customer is ALWAYS responsible for their own data and their own access management, in every model. The provider can be responsible for the storage medium; it is never responsible for deciding who should be able to read the data or for the correctness of the permission you granted.

3.9 Major providers and flagship services

4. Must-memorise block

Provider vs customer — one line each

• IaaS — Provider: networking, storage, servers, virtualisation. Customer: OS, middleware, runtime, application, data, IAM.
• PaaS — Provider: everything from hardware up through the runtime (incl. OS and middleware patching). Customer: application code, data, IAM.
• SaaS — Provider: everything including the application. Customer: data content, access management, usage configuration.
• FaaS/serverless — Provider: everything PaaS does plus the execution environment and scale-to-zero. Customer: function code, triggers, configuration, data, IAM.

Deployment models — one line each

• Public — provider-owned infrastructure, offered over the internet to any paying customer, multi-tenant. Use: general workloads, variable load, low CapEx.
• Private — dedicated to one organisation, operated by it or a third party, single-tenant. Use: regulated/sensitive data, maximum control.
• Hybrid — two or more deployment models (usually private + public) bound by technology enabling data and application portability. Use: keep sensitive data in-house, burst the rest to public cloud.
• Community — shared by several organisations with common concerns (compliance, security, mission), access restricted to members. Use: government, banks, universities.

Service-name equivalence

The always-yours rule

• The customer is always responsible for their own data and their own access management (IAM) — in IaaS, PaaS, SaaS and FaaS alike. The provider secures of the cloud; the customer secures in the cloud.

Fast discriminators

• "You patch the OS" → IaaS. "You deploy code only" → PaaS. "You only log in" → SaaS. "You upload a function, billed per invocation" → FaaS.
• EC2 / Azure VM / GCE → IaaS. App Engine / Heroku / Elastic Beanstalk / Azure App Service → PaaS. Gmail / Salesforce / Microsoft 365 / Dropbox → SaaS.
• Elasticity = scales up and down automatically. Scalability = can handle growth.
• Hybrid = public + private. Multi-cloud = two or more public providers.

5. Worked examples

Example 1 — Scenario to service model

A startup wants to run a custom Node.js application. They do not want to patch operating systems or configure load balancers, but they do want to control the application code and its dependencies. Which service model?

Reasoning. Work down the stack and ask where the customer stops.

• They control the application code → so it is not SaaS (in SaaS you get someone else's finished application).
• They explicitly do not want to manage the OS → so it is not IaaS (in IaaS the OS is yours to patch).
• Code yes, OS no → that boundary is exactly PaaS.

Answer: PaaS.

Example 2 — Responsibility boundary

In an IaaS deployment, who is responsible for applying security patches to the guest operating system?

Reasoning. In IaaS the provider hands you a virtual machine. Everything from the OS upward is yours. The provider handles the hypervisor, physical hosts, network and datacentre.

Answer: the customer. In PaaS the same question flips to the provider, and that flip is the whole point of the question.

Example 3 — Deployment model from a compliance constraint

A hospital must keep patient records on infrastructure it controls, but wants to run its public-facing appointment website on rented capacity that scales. Which deployment model?

Reasoning. Two different requirements with two different answers — records need private, website needs public. A deployment that combines both, with data able to move between them, is by definition hybrid.

Answer: hybrid cloud. The distractor is community cloud, which is for several organisations sharing a common concern, not one organisation using two clouds.

Example 4 — Elasticity as the trigger word

An application experiences unpredictable traffic spikes. The business wants to pay only for the capacity actually used, with no upfront hardware purchase. Which cloud characteristic is being described, and which service model best supports it with the least management effort?

Reasoning. "Pay only for what is used" is the pay-as-you-go / measured-service characteristic; "unpredictable spikes handled automatically" is rapid elasticity. For least management effort with automatic scaling, PaaS (or serverless/FaaS) beats IaaS, where you would have to configure the auto-scaling groups yourself.

Answer: rapid elasticity + measured service; PaaS/serverless.

Example 5 — Odd one out

Which of the following is NOT an example of SaaS? (a) Gmail (b) Salesforce (c) Amazon EC2 (d) Dropbox

Reasoning. EC2 gives you a virtual machine — raw infrastructure you must configure. The other three are finished applications you log into.

**Answer: (c) Amazon EC2

6. Traps and gotchas

7. Practice questions

Attempt all ten before looking at the answer key.

1. [Easy] (C10 — service models) A company wants complete control over the operating system, installed runtimes and networking configuration of its servers, without buying hardware. Which service model fits? (a) IaaS (b) SaaS (c) PaaS (d) FaaS

2. [Easy] (C10 — service models) Which of the following is a SaaS offering? (a) Amazon EC2 (b) Azure Virtual Machines (c) Google App Engine (d) Microsoft 365

3. [Medium] (C10 — responsibility) In a PaaS deployment, which of the following remains the customer's responsibility? (a) Patching the guest operating system (b) The application code and its data (c) Maintaining the runtime environment (d) Physical datacentre security

4. [Medium] (C10 — deployment models) Several competing banks jointly fund a cloud environment built to a shared regulatory standard, accessible only to those banks. This is best described as: (a) Community cloud (b) Private cloud (c) Hybrid cloud (d) Public cloud

5. [Medium] (C10 — deployment models) An organisation keeps its customer database on its own dedicated infrastructure but runs its marketing website on a public provider, with data flowing between them. This is: (a) Private cloud (b) Hybrid cloud (c) Community cloud (d) Multi-cloud

6. [Easy] (C10 — service models) Ranked from most customer control to least, the correct order is: (a) SaaS → PaaS → IaaS (b) IaaS → SaaS → PaaS (c) PaaS → IaaS → SaaS (d) IaaS → PaaS → SaaS

7. [Medium] (C10 — shared responsibility) Under the shared responsibility model, which item is the customer's responsibility in every service model, including SaaS? (a) Hypervisor patching (b) User access management and data (c) Physical network hardware (d) Runtime version upgrades

8. [Hard] (C10 — service models) A team deploys individual event-driven functions that run only when triggered and are billed per invocation, with no always-on server. This is best classified as: (a) FaaS (b) IaaS (c) SaaS (d) Private cloud

9. [Medium] (C10 — provider mapping) Which set correctly pairs equivalent compute services across providers? (a) Lambda / Azure Virtual Machines / Cloud Storage (b) EC2 / Azure Blob Storage / Cloud SQL (c) EC2 / Azure Virtual Machines / Compute Engine (d) S3 / Azure Functions / Compute Engine

9. (c) EC2 / Azure Virtual Machines / Compute Engine. All three are the virtual-machine compute service of their provider.

• (b) mixes compute with object storage and a managed database.
• (a) mixes serverless, compute and storage.
• (d) mixes storage, serverless and compute.

10. [Hard] (C10 — characteristics) A retailer's traffic is steady for eleven months and triples during a festival week, after which it returns to normal and the extra capacity is released automatically. Which characteristic is this, and which is it most often confused with? (a) Scalability, confused with elasticity (b) Multi-tenancy, confused with resource pooling (c) Elasticity, confused with scalability (d) Measured service, confused with availability

10. (c) Elasticity, confused with scalability. Capacity that expands and automatically contracts with demand is elasticity. Scalability is only the ability to grow.

• (a) has the pair the right way round but the wrong primary term.
• (b) and (d) name real characteristics that do not describe automatic expand-and-release.

8. Resources

All links verified resolving 2026-09-16.

9. Self-check

Tick every box before moving on.

• [ ] I can name the nine stack layers and say who manages each one under IaaS, PaaS and SaaS
• [ ] Given a scenario, I can pick the service model in under 15 seconds using the "do I manage the OS?" test
• [ ] I can define all four deployment models and distinguish hybrid from community without hesitating
• [ ] I can state the always-yours rule and apply it to a SaaS responsibility question
• [ ] I can name the compute, object-storage, relational-database and serverless service for AWS, Azure and GCP
• [ ] I can explain the difference between scalability and elasticity in one sentence each
• [ ] I can explain why Lambda is FaaS and not PaaS
• [ ] I scored 8/10 or better on the practice questions without looking back

10. Sources