Draw the responsibility line for six services
Task
For six real services, decide whether they are IaaS, PaaS or SaaS, and then state exactly which layers you are responsible for securing and which the provider is. The shared responsibility model is examined as a boundary question, and the boundary moves with the service model.
Steps
- Classify each: a virtual machine you install an OS on; a managed database where you supply only schema and queries; a web-based email service; a container platform where you push an image; a managed Kubernetes control plane with your own worker nodes; a hosted CRM.
- For each, draw a stack — physical, network, hypervisor, OS, runtime, application, data — and put a line where your responsibility begins.
- Note the one constant: your data is always yours. No service model moves responsibility for data classification, access control or backup onto the provider, whatever the marketing says.
- Now the deployment models. For each of public, private, hybrid and community, write one scenario where it is the right answer and one where it is the wrong one.
- Answer the scenario the exam likes: a company with a regulatory requirement to keep patient records in its own datacentre but wanting burst capacity for analytics. Name the model and the connectivity it needs.
Verify
python3 -c "
svc = {'VM you install the OS on':'IaaS - you own OS upward',
'Managed database, schema only':'PaaS - you own data and schema',
'Web-based email':'SaaS - you own data and access control only',
'Push a container image':'PaaS - you own the image and app',
'Managed control plane, your nodes':'IaaS/PaaS hybrid - you own the nodes',
'Hosted CRM':'SaaS - you own data and users'}
for k, v in svc.items(): print(f'{k:<36}{v}')
print()
print('Burst analytics with on-prem records = hybrid cloud, needs a VPN or direct connection')
"Six classifications and one scenario answer. The managed-Kubernetes line is the one that starts arguments, and that is worth noticing: the models are a spectrum, and exam questions pick unambiguous examples.
Notes
The mistake that costs marks is treating the model as a property of the technology rather than of the contract. The same container can be IaaS, PaaS or SaaS depending on who patches the host underneath it.
The connectivity question follows the deployment model every time. Public needs an internet gateway; private needs nothing new; hybrid needs a VPN or a dedicated circuit, and that is the piece exam scenarios usually leave for you to supply.