Study guide
6.2 Cloud Architecture & Service Categories
CompTIA Tech+ FC0-U71
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: IT Concepts & Terminology
1.1 CompTIA Tech+ Overview & The Computing Cycle 1.2 Notational Systems & Character Representation 1.3 Units of Measure for Storage, Throughput & Speed
2 Chapter 2: Troubleshooting Methodology & Computing Devices
2.1 CompTIA 6-Step Troubleshooting Process 2.2 Computing Device Categories & Purposes 2.3 IoT, Smart Devices & Specialized Hardware
3 Chapter 3: Internal Hardware Components & System Storage
3.1 Motherboards, CPUs & Memory Architecture 3.2 Firmware, Power Delivery & Hardware Configuration 3.3 Storage Media & Drive Technologies
4 Chapter 4: Peripherals, Interfaces & Connections
4.1 Peripheral Device Types & Configuration 4.2 Wired I/O Interfaces & Video Cable Standards 4.3 Wireless Peripheral Connectivity & Short-Range RF
5 Chapter 5: Networking Technologies & Internet Services
5.1 Internet Access Technologies & Connection Types 5.2 Network Scopes & Physical Infrastructure 5.3 Wi-Fi Standards, Bands & Performance 5.4 IP Addressing & Fundamental Network Protocols
6 Chapter 6: Virtualization, Cloud Computing & AI Fundamentals
6.1 Virtualization Concepts & Hypervisor Types 6.2 Cloud Architecture & Service Categories 6.3 Artificial Intelligence Concepts & Modern Use Cases
7 Chapter 7: Operating Systems Architecture & Management
7.1 Operating System Categories & Core Functions 7.2 OS Architecture, Process Management & Utilities 7.3 File Systems, Directory Trees & Access Control
8 Chapter 8: Applications, Software Licensing & Web Browsing
8.1 Software Applications & Business Productivity Suites 8.2 Software Deployment Architectures & Licensing 8.3 Web Browser Architecture & Security Configuration
9 Chapter 9: Software Development & Programming Concepts
9.1 Programming Language Categories & Paradigms 9.2 Data Types, Variables & Identifiers 9.3 Programming Logic, Control Flow & Data Structures
10 Chapter 10: Data Concepts, Analytics & Database Fundamentals
10.1 The Value of Data, Information & Big Data Analytics 10.2 Relational Database Concepts & Schema Structure 10.3 Non-Relational Databases & Core SQL Commands
11 Chapter 11: Data Protection, Backup & Recovery
11.1 Data Backup Methodologies & Recovery Strategies 11.2 Backup Media Destinations & Disaster Recovery
12 Chapter 12: Security Concepts, Access Control & Device Hardening
12.1 Foundational Security Principles & the CIA Triad 12.2 Security Threats, Social Engineering & Malware Defense 12.3 Physical Security & Endpoint Hardening Practices
13 Chapter 13: Identity, Encryption & Wireless Network Security
13.1 Password Security Practices & Multi-Factor Authentication 13.2 Encryption Concepts & Cryptographic Applications 13.3 Wireless Network Security & Access Controls
6.2 Cloud Architecture & Service Categories
Key Takeaways Explain This Topic AI
The National Institute of Standards and Technology (NIST SP 800-145) defines cloud computing through five essential characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service.
Cloud service models follow the SPI hierarchy: Infrastructure as a Service (IaaS) supplies raw compute/storage/networking, Platform as a Service (PaaS) provides development runtimes and managed databases, and Software as a Service (SaaS) delivers turnkey web applications.
Cloud deployment models define operational access and tenancy: Public cloud (multi-tenant provider), Private cloud (single-tenant enterprise), Hybrid cloud (bridged public/private environments), Community cloud (shared industry consortium), and Multi-cloud (multi-vendor diversification).
Under the Shared Responsibility Model, cloud providers secure the physical facilities, host hardware, and hypervisors, while tenant organizations remain permanently accountable for data classification, user credential security, and access governance.
Last updated: September 2026
Cloud Architecture & Service Categories
Exam Focus: Cloud computing shifts enterprise IT from upfront capital expenditures (CapEx) for physical server hardware to flexible, operational expenditures (OpEx) for metered utility computing. Mastering the five NIST essential characteristics, distinguishing IaaS from PaaS and SaaS, and navigating the Shared Responsibility Model are primary competencies tested across modern IT examinations.
NIST Essential Characteristics of Cloud Computing
The universally accepted benchmark definition of cloud computing is established by the National Institute of Standards and Technology (NIST Special Publication 800-145) . NIST defines cloud computing as a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources that can be rapidly provisioned and released with minimal management effort.
NIST specifies Five Essential Characteristics that distinguish genuine cloud services from traditional hosted datacenters: +-------------------------------------------------------------------------+
- | THE FIVE NIST CLOUD ESSENTIAL CHARACTERISTICS |
- | |
- | 1. ON-DEMAND SELF-SERVICE --> Automated instant provisioning |
- | 2. BROAD NETWORK ACCESS --> Accessible anywhere on any client |
- | 3. RESOURCE POOLING --> Multi-tenant shared dynamic hardware |
- | 4. RAPID ELASTICITY --> Dynamic real-time scaling up & down |
- | 5. MEASURED SERVICE --> Metered pay-as-you-go billing |
- +-------------------------------------------------------------------------+
- 1. On-Demand Self-Service
A consumer can unilaterally provision computing capabilities, such as server processing time, storage capacity, and virtual networks, automatically as needed without requiring human interaction with the service provider's personnel. An engineer logs into a web management portal or executes an API call, and new server instances spin up instantly.
2. Broad Network Access
Capabilities are available over the network and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, tablets, laptops, and workstations) using standard Internet protocols (HTTP/HTTPS, SSH, TLS).
3. Resource Pooling
The provider's computing resources are pooled to serve multiple consumers using a multi-tenant model , with different physical and virtual resources dynamically assigned and reassigned according to consumer demand. The customer generally has no control or knowledge over the exact physical location of the provided resources (e.g., which specific rack server or silicon chip is executing their VM), though they can specify location at a higher level of abstraction (e.g., country, state, or datacenter availability zone).
4. Rapid Elasticity
Capabilities can be elastically provisioned and released—in some cases automatically—to scale rapidly outward and inward commensurate with demand. To the consumer, the capabilities available for provisioning often appear to be unlimited and can be appropriated in any quantity at any time.
5. Measured Service
Cloud systems automatically control and optimize resource use by leveraging a metering capability at some level of abstraction appropriate to the type of service (e.g., storage consumed, processing cycles executed, bandwidth transferred, active user accounts). Resource usage can be monitored, controlled, reported, and billed transparently, forming the basis of pay-as-you-go utility pricing.
Scalability vs. Elasticity: A Critical Technical Distinction
While frequently used interchangeably in informal conversation, Scalability and Elasticity represent distinct architectural principles in IT:
Scalability: The capacity of an IT system to accommodate increasing workload volumes by expanding its infrastructure resources. Scalability can be achieved through:
Vertical Scalability (Scaling Up): Adding more resources to an existing node—such as upgrading a virtual server from 4 vCPUs and 16 GB RAM to 16 vCPUs and 64 GB RAM. Vertical scaling has a strict hardware ceiling.
Horizontal Scalability (Scaling Out): Adding more independent nodes to a system pool—such as placing ten identical web servers behind a network load balancer. Horizontal scaling offers virtually limitless growth.
Elasticity: The automated, dynamic adaptation of resources in real time to match fluctuating demand. An elastic system scales out when traffic surges and contracts (scales in) when traffic recedes , terminating unneeded instances to eliminate idle infrastructure costs. Scalability is about handling peak capacity; elasticity is about matching capacity to demand dynamically to optimize cost.
Dimension Scalability Elasticity
Core Concept Ability to handle growing workload capacity Ability to dynamically expand and contract resources in real time
Mechanism Architectural redesign, provisioning more hardware Automated rule-based scaling (e.g., CPU threshold triggers)
Direction Primarily expansion (Scaling Up / Scaling Out) Bidirectional (Expands during surges; contracts during lulls)
Billing Impact Accommodates long-term planned growth Optimizes short-term utility costs by killing idle servers
Primary Use Case Multi-year corporate growth, expanding user base Flash sales, Black Friday retail spikes, tax season portals
The SPI Cloud Service Hierarchy: IaaS, PaaS, and SaaS
Cloud computing services are organized into three primary delivery tiers, historically known as the SPI Model ( S oftware, P latform, and I nfrastructure). Each model represents a different division of operational responsibility between the customer and the cloud service provider. THE SPI CLOUD SERVICE STACK
- +-------------------------------------------------------------------------+
- | SaaS: Software as a Service (Turnkey Web Applications) |
- | - Microsoft 365, Google Workspace, Salesforce, Dropbox |
- +-------------------------------------------------------------------------+
- | PaaS: Platform as a Service (Runtimes & Development Frameworks) |
- | - AWS Elastic Beanstalk, Azure App Services, Google App Engine |
- +-------------------------------------------------------------------------+
- | IaaS: Infrastructure as a Service (Raw Compute, Storage & Networks) |
- | - AWS EC2, Azure Virtual Machines, Google Compute Engine |
- +-------------------------------------------------------------------------+
- 1. Infrastructure as a Service (IaaS)
In an Infrastructure as a Service (IaaS) model, the cloud provider supplies raw computing infrastructure: virtualized server instances (compute), block/object storage volumes, and software-defined networking components (subnets, routing tables, firewalls, and load balancers).
Customer Control: Maximum administrative control. The customer is provided with a blank virtual machine and is responsible for selecting, installing, and licensing the operating system, configuring network routing, applying security patches, installing middleware, and managing applications.
Provider Role: The provider manages the physical datacenters, environmental cooling, electrical power, physical server hardware, and virtualization hypervisors.
Target Audience: Systems administrators, cloud architects, and network engineers migrating existing on-premises server environments directly into the cloud ("lift-and-shift").
Representative Examples: Amazon Elastic Compute Cloud (AWS EC2), Microsoft Azure Virtual Machines, Google Compute Engine (GCE).
2. Platform as a Service (PaaS)
In a Platform as a Service (PaaS) model, the cloud provider delivers a fully managed hardware and software framework designed specifically for software developers. The provider provisions and manages the underlying operating system, web servers, execution runtimes (such as Python, Node.js, Java, .NET, or PHP), and managed database engines.
Customer Control: The customer does not manage, configure, or patch the underlying operating system or server hardware. The customer is solely responsible for authoring application code, configuring application settings, and managing data.
Provider Role: The provider automates OS maintenance, applies security patches, handles runtime updates, and provides built-in auto-scaling and continuous deployment integrations.
Target Audience: Software developers and DevOps engineers who want to build, deploy, and scale web applications rapidly without wasting time administering operating systems or server infrastructure.
Representative Examples: AWS Elastic Beanstalk, Microsoft Azure App Service, Google App Engine, Heroku, AWS Lambda (Serverless PaaS).
3. Software as a Service (SaaS)
In a Software as a Service (SaaS) model, the cloud provider delivers a complete, fully functional software application over the Internet, typically accessible through a standard web browser or lightweight mobile application.
Customer Control: The customer manages only user account access, group permissions, security credentials, and organization-specific data/files. The customer has zero control or visibility over the underlying servers, operating systems, database engines, or application source code.
Provider Role: The provider manages the entire technological stack from top to bottom, including server hardware, virtualization, operating systems, application code, feature rollouts, high availability, and routine backups.
Target Audience: Business end-users, employees, corporate departments (HR, sales, finance), and general consumers.
Representative Examples: Microsoft 365 (Word, Excel, Exchange Online), Google Workspace (Gmail, Docs, Drive), Salesforce CRM, Dropbox, ServiceNow, Workday.
Cloud Service Stack Management Comparison
- Technical Stack Layer On-Premises IaaS PaaS SaaS
- Applications Customer Customer Customer Provider
- Data & Access Governance Customer Customer Customer Customer
- Runtime & Middleware Customer Customer Provider Provider
- Operating System & Patching Customer Customer Provider Provider
- Virtualization / Hypervisor Customer Provider Provider Provider
- Physical Server Hardware Customer Provider Provider Provider
- Storage Infrastructure Customer Provider Provider Provider
- Physical Networking & Power Customer Provider Provider Provider
- Datacenter Facilities Customer Provider Provider Provider
- Cloud Deployment Models
Cloud deployment models define where the infrastructure is hosted , who owns and manages it , and who is permitted to access it . CLOUD DEPLOYMENT ARCHITECTURES
- +-----------------------+ +-----------------------+
- | PUBLIC CLOUD | | PRIVATE CLOUD |
- | (Multi-tenant, AWS, | | (Single-tenant, Corp |
- | Azure, GCP over Net) | | Datacenter or Hosted)|
- +-----------------------+ +-----------------------+
- \ /
- \ /
- +-------------------------------+
- | HYBRID CLOUD |
- | (Bridged via VPN / DirectLink)|
- +-------------------------------+
- 1. Public Cloud
The cloud infrastructure is owned and operated by a third-party commercial cloud provider (such as AWS, Microsoft Azure, or Google Cloud). Compute, storage, and network resources are pooled and delivered over the public Internet to multiple tenant organizations.
Characteristics: Multi-tenant architecture (tenants share physical hardware isolated by hypervisors), zero capital expense (CapEx), high elasticity, and massive global economies of scale.
Best For: Public-facing web applications, development/test environments, startups, and general enterprise workloads.
2. Private Cloud
The cloud infrastructure is provisioned for exclusive use by a single organization comprising multiple consumers or business units. It can be physically located in the enterprise's own on-premises datacenter or hosted off-site by a third-party service provider.
Characteristics: Single-tenant architecture, dedicated physical hardware, maximum administrative control, customized security policies, and strict compliance alignment. However, it requires significant capital expenditures and ongoing administrative maintenance.
Best For: Financial institutions, defense contractors, healthcare organizations, and government agencies with strict regulatory compliance, data sovereignty, and security mandates.
3. Hybrid Cloud
A composition of two or more distinct cloud infrastructures (typically one or more private clouds integrated with one or more public clouds ) that remain unique entities but are bound together by standardized technology enabling data and application portability.
Key Mechanism (Cloud Bursting): An organization runs baseline workloads within its private datacenter. When sudden traffic surges exceed private capacity, the system automatically "bursts" overflow traffic into public cloud instances, scaling back down when demand subsides.
Best For: Enterprises migrating legacy systems to the cloud gradually, or businesses maintaining highly sensitive customer records on-premises while running scalable web portals in the public cloud.
4. Community Cloud
The cloud infrastructure is provisioned for exclusive use by a specific community of consumers from organizations that have shared concerns (e.g., mission objectives, security requirements, regulatory policies, or compliance jurisdictions). It may be owned, managed, and operated by one or more of the organizations in the community or a third party.
Best For: Groups of hospitals sharing research data, regional government municipal councils collaborating on smart-city telemetry, or financial credit unions sharing transaction clearing frameworks.
5. Multi-Cloud Strategy
A deliberate architectural strategy where an enterprise utilizes services from multiple distinct public cloud providers simultaneously (e.g., deploying web applications in AWS, utilizing Microsoft Azure for identity management and Active Directory, and running Big Data analytics in Google Cloud).
Advantages: Prevents vendor lock-in, increases bargaining power during contract negotiations, maximizes geographic fault tolerance, and allows teams to select best-of-breed features from each provider.
The Cloud Shared Responsibility Model
A critical security concept tested across IT certification examinations is the Shared Responsibility Model . Cloud security is not the sole responsibility of the provider, nor is it the sole responsibility of the customer; it is an explicit division of accountability determined by the chosen service model. THE SHARED RESPONSIBILITY SECURITY MATRIX
- +-----------------------+--------+--------+--------+--------+
- | Security Layer | On-Prem| IaaS | PaaS | SaaS |
- +-----------------------+--------+--------+--------+--------+
- | Data Classification | Cust | Cust | Cust | Cust |
- | User Identity & IAM | Cust | Cust | Cust | Cust |
- | Application Code | Cust | Cust | Cust | Prov |
- | Operating System & OS | Cust | Cust | Prov | Prov |
- | Hypervisor Management | Cust | Prov | Prov | Prov |
- | Physical Datacenter | Cust | Prov | Prov | Prov |
- +-----------------------+--------+--------+--------+--------+
- Cust = Customer Responsibility | Prov = Cloud Provider
- Security OF the Cloud vs. Security IN the Cloud
Major cloud providers define the division of responsibility through two distinct operational realms:
Security OF the Cloud (Provider Responsibility): The cloud provider is universally responsible for protecting the infrastructure that runs all of the services offered in the cloud. This encompasses:
Physical security of datacenters (biometric access, armed perimeter guards, 24/7 CCTV surveillance).
Environmental facilities (redundant electrical power feeds, uninterruptible power supplies [UPS], diesel generators, fire suppression, HVAC cooling).
Physical server hardware, storage arrays, network switches, fiber cabling, and the hypervisor virtualization layer.
Security IN the Cloud (Customer Responsibility): The customer is responsible for configuring, managing, and securing everything they deploy inside the cloud environment. This encompasses:
Operating system installation and security patch management (in IaaS).
Network access control lists (ACLs) and security group firewall rules.
Application software security and bug mitigation.
Identity and Access Management (IAM), enforcing Multi-Factor Authentication (MFA), and password complexity.
Data encryption (both Data at Rest using BitLocker/AES-256 and Data in Transit using TLS/HTTPS).
The Golden Rule of Cloud Security: Regardless of whether an organization deploys Infrastructure as a Service, Platform as a Service, or Software as a Service, the customer retains responsibility for its data, identities, access choices, and the controls assigned to it by the service model . If an employee's SaaS credentials are stolen due to weak passwords, the customer—not the SaaS provider—is responsible for the resulting breach.
Common Exam Traps & Real-World Pitfalls
Trap 1: The SaaS Zero-Responsibility Fallacy. Candidates frequently assume that because SaaS providers manage the software stack, the customer has no security duties. Customers remain strictly responsible for managing user access permissions, enabling MFA, provisioning and deprovisioning employee accounts, and ensuring sensitive data is not improperly shared publicly.
Trap 2: Conflating Elasticity with Scalability. Remember: Scalability is the architectural capacity to grow to meet larger workloads (scaling up or out). Elasticity is the dynamic, automated behavior of expanding during demand spikes and immediately contracting during troughs to avoid paying for idle capacity.
Trap 3: Believing Multi-Tenancy Exposes Data to Other Tenants. In a public cloud, multiple customers share the same physical server hardware (multi-tenancy). Some believe this means adjacent tenants can view their memory or files. In reality, hypervisors and cryptographic virtualization boundaries logically isolate each tenant's memory space and storage volumes, preventing unauthorized inter-tenant data access.