Cloud service models (IaaS, PaaS, SaaS) describe how much responsibility the customer vs. the provider has for infrastructure, platform and applications; deployment models describe where the cloud is placed: public, private, hybrid, community, multi-cloud.
Shared responsibility
| Layer | On-prem | IaaS | PaaS | SaaS |
|---|---|---|---|---|
| Data | Customer | Customer | Customer | Customer |
| Application | Customer | Customer | Customer | Provider |
| OS | Customer | Customer | Provider | Provider |
| Virtualization | Customer | Provider | Provider | Provider |
| Hardware/DC | Customer | Provider | Provider | Provider |
Key topic: the shared responsibility model – cloud is NOT “no responsibility”; the split depends on the service model.
Service models
| Model | Provider delivers | Customer controls | Typical use |
|---|---|---|---|
| IaaS | DC, network, storage, servers, virtualization | OS, patches, firewall, apps, data | On-prem migration, full control |
| PaaS | IaaS + OS, runtime, middleware | Application + data | Fast app development |
| SaaS | The whole stack incl. the app | Users, data, configuration | Standard apps (mail, CRM) |
- IaaS = a virtual datacenter: provider runs hardware + virtualization, customer runs OS/software; networks built with VPC/VNet, subnets, routing, security rules. On-demand VMs, pay-as-you-go, load balancers, autoscaling, snapshots, VPN/Direct Connect/ExpressRoute. Examples: AWS EC2, Azure VMs, GCP Compute Engine.
- PaaS = upload your code: provider handles OS, patches, runtime; managed runtimes (Java/.NET/Node.js), CI/CD, health checks, app metrics. Examples: Elastic Beanstalk, Azure App Service, App Engine.
- SaaS = just use the app: provider runs everything; SSO, MFA, API integrations. Examples: Microsoft 365, Salesforce, Google Workspace.
Exam tip: IaaS ≈ virtual server · PaaS ≈ upload code · SaaS ≈ just use the app
Deployment models
| Model | Description | Typical use |
|---|---|---|
| Public cloud | Infrastructure shared between many customers; provider owns the hardware, logical isolation | Standard workloads |
| Private cloud | Cloud tech dedicated to one org (on-prem or hosted): compliance, data sovereignty, control | Regulated industries |
| Hybrid cloud | On-prem + public cloud connected via site-to-site VPN, MPLS or dedicated links (ExpressRoute/Direct Connect); shared network and identity | Gradual migration, legacy, burst capacity |
| Community cloud | Shared between organizations with the same requirements | Government, health, education |
| Multi-cloud | Several public providers at the same time (AWS + Azure + GCP), often without integration | Avoid vendor lock-in, redundancy, best-of-breed |
Hybrid vs multi-cloud (classic exam trap)
| Point | Hybrid cloud | Multi-cloud |
|---|---|---|
| On-prem | ✅ Yes | ❌ Not required |
| Multiple providers | ❌ Not required | ✅ Yes |
| Integration | Tight | Often loose |
| Complexity | Network & security | Operations & governance |
Hybrid ≠ multi-cloud: hybrid = on-prem + cloud; multi-cloud = several providers. Multi-cloud is not necessarily hybrid.
CCNA: know the definitions and distinguish hybrid from multi-cloud. CCNP: WAN integration, routing between on-prem and cloud, VPN/redundancy/performance, identity & security.