Cloud Computing Concepts & Architectures
Start with the NIST definitions
NIST SP 800-145 supplies the vocabulary the exam assumes. Five essential characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. Three service models (SaaS, PaaS, IaaS) and four deployment models (public, private, hybrid, community). You are rarely asked to recite these; you are asked to use them, because every question about who does what resolves through the service and deployment model in play.
The responsibility boundary moves
In IaaS the provider secures facilities, hardware, and the hypervisor; the customer owns the guest OS and everything above it. In PaaS the provider adds OS, runtime, and often middleware; the customer owns applications, data, and identity configuration. In SaaS the provider runs nearly everything, yet the customer still owns data classification, user lifecycle, sharing settings, and anything it configures.
Layers, not boxes
A useful mental model is a stack: physical, virtualization, network, storage, compute, application, data, and metadata. Each control is inherited, shared, or owned. Sketch that matrix before answering a responsibility question.
Traps
- Private cloud does not by definition mean single-tenant; resource pooling and multi-tenancy remain normal.
- Elasticity (automatic expansion and contraction with demand) is not the same as scalability.
- Measured service describes metering capability, not a billing model.
- Community cloud is shared by organizations with a common concern, not by the general public.
Rule of thumb
'The provider secures what it operates; you secure what you configure, put in, and let in.' If a control touches your data, your identities, or your configuration, assume you own it unless a contract says otherwise.