Cloud Fundamentals
Cloud Fundamentals
This domain tests how well you can classify cloud services and reason about responsibility boundaries, not just recite definitions. Expect scenarios that ask whether a design is truly cloud-native or merely virtualized, and who operates each layer.
Core rules
- NIST's five characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity, measured service. A private data center with VMs but no self-service API or metering is virtualization, not cloud.
- Service models shift responsibility: IaaS gives the tenant guest OS and above; PaaS gives runtime and middleware; SaaS gives only application configuration and data.
- Deployment models describe ownership and tenancy: public, private, hybrid, community. Hybrid implies orchestration and identity federation across boundaries, not simply a VPN.
- Multi-tenancy needs isolation at compute, network, and identity layers; elasticity needs automation and capacity pooling.
Worked example
A tenant uses a provider API to create VMs, chooses a guest image, installs its own agents, and is billed per vCPU-hour. The provider patches the hypervisor only. Reasoning: self-service API and metering prove cloud characteristics; the tenant controls the guest OS, so the boundary is above the hypervisor. That is IaaS, not PaaS. If the tenant only pushed code to a managed runtime, it would be PaaS.
Traps
- Calling any virtualized environment a cloud. Without self-service and measured service, it fails the NIST test.
- Putting OS patching on the provider in IaaS. The tenant owns the guest.
- Treating hybrid as 'public plus private' without a common control plane or identity.