Cloud Concepts, Architecture and Design
The three axes
NIST SP 800-145 defines cloud computing by five essential characteristics (on-demand self-service, broad network access, resource pooling, rapid elasticity, measured service), three service models (IaaS, PaaS, SaaS), and four deployment models (public, private, community, hybrid). Exam questions rarely ask you to recite these; they ask you to apply them. Keep the axes separate: the service model describes how much of the stack the provider runs, while the deployment model describes who the infrastructure is dedicated to. A private cloud can sit in a colocation facility; a public cloud can host a single tenant; a community cloud serves organizations with shared concerns such as a regulator.
Reference architecture and roles
Know the NIST cloud reference architecture actors - consumer, provider, auditor, broker, carrier - and be able to say which one aggregates and negotiates services (broker) versus provides connectivity (carrier). Design concepts tested include loose coupling, statelessness, elasticity, resiliency, multitenancy, and federation.
Shared responsibility
Responsibility slides with the service model. The provider always owns physical facilities, host hardware, and the hypervisor layer; the customer always owns data classification, identity provisioning decisions, and authorization of access. The fuzzy line is the guest OS and runtime: on IaaS the customer patches it, on PaaS the provider does. Memorize that line - it answers many questions.
Worked example
A vendor supplies the OS, runtime, and scaling while the customer uploads application code and configuration. Is this IaaS or PaaS? Apply the rule of thumb: whoever patches the guest OS owns the platform layer. Because the provider patches the OS, this is PaaS, and the customer's responsibility begins at the application, its dependencies, and its data.
Trap to avoid: equating 'private' with 'secure' or 'on-premises'. Location does not change the model.