Build the idea first, then use the next activity to check it.
Renting infrastructure instead of owning it
Service and deployment models, the connectivity options between you and a provider, and where the responsibility boundary actually falls.
What you will be able to do
- Distinguish infrastructure, platform and software as a service by what you still manage
- Compare public, private, hybrid and community deployment models
- Describe the connectivity options between a site and a provider
- Explain what the shared responsibility model does and does not cover
Before this: You should know what a VLAN and a subnet are, and what a WAN link is - see "Shapes networks are built in".
Why it matters: Cloud questions on Network+ are about vocabulary and boundaries rather than any particular provider. The boundary questions are the ones worth real attention, because "the provider handles that" is the assumption behind a large share of real outages and breaches.
Cloud is a commercial arrangement before it is a technology: somebody else owns the hardware, and you rent capacity on it. Almost everything in the vocabulary follows from one question - how much of the stack are you still responsible for.
The three service models
| Model | Provider manages | You manage | Example |
|---|---|---|---|
| Infrastructure as a service | Hardware, virtualisation, network fabric | Operating system, runtime, application, data | A rented virtual machine |
| Platform as a service | All of the above, plus OS and runtime | Application and data | A managed database or application host |
| Software as a service | Everything except your data and access | Data, accounts, configuration | A hosted mail or ticketing system |
Reading down the "you manage" column is the whole distinction. Moving to a higher service model means handing over more work and, with it, more control - including control over when things change.
The four deployment models
| Model | Meaning | Chosen when |
|---|---|---|
| Public | Shared infrastructure, any customer | Cost and elasticity matter most |
| Private | Dedicated to one organisation, wherever it sits | Regulation or control requires it |
| Hybrid | Both, joined together | Some workloads have moved and others cannot |
| Community | Shared between organisations with common requirements | A sector shares a compliance regime |
Private does not mean on-premises. A provider can dedicate hardware to one customer in their own facility, and that is still private cloud. What defines it is exclusivity, not location.
Getting there from here
The network question is how traffic reaches the provider, and the options trade cost against predictability in the familiar way.
| Option | Path | Predictable performance | Cost |
|---|---|---|---|
| Over the internet | Public internet, usually encrypted in transit | No | Lowest |
| Site-to-site VPN | Encrypted tunnel over the internet | No - the internet is still underneath | Low |
| Dedicated connection | A private circuit into the provider | Yes | Highest |
| Colocation cross-connect | A cable in a shared facility | Yes | Varies |
Elasticity, and what it costs
The genuine technical advantage is elasticity - capacity that grows and shrinks with demand, billed accordingly. That is a real difference from owned hardware, which is sized for the worst hour of the year and idle the rest of the time.
The corresponding cost is that everything becomes a running expense rather than a purchase, and that expense scales with use rather than with capacity. Costs that were fixed and predictable become variable and occasionally surprising, which is a budgeting change more than a technical one - but it is the change organisations most often underestimate.
The network inside a provider
Providers offer the same primitives under different names, and recognising them is most of what is needed here.
- A virtual private cloud is an isolated address space you control - the equivalent of your own routed network.
- Subnets inside it work as they do anywhere, usually pinned to an availability zone.
- Security groups filter traffic per instance, and are stateful.
- Network access control lists filter per subnet, and are typically stateless - so return traffic needs its own rule.
The stateful and stateless distinction is the one that catches people, and it is the same distinction as on a router: a stateless list needs a rule for the reply, and forgetting it produces a connection that succeeds outbound and never comes back.
Terminology
- Infrastructure as a service
- Rented compute and network on which you run your own operating system and everything above it.
- Shared responsibility model
- The division of duties between provider and customer. Data and access control always remain the customer's.
- Elasticity
- Capacity that grows and shrinks with demand, billed by use rather than by installed size.
- Virtual private cloud
- An isolated, customer-controlled address space within a provider's infrastructure.
Key takeaways
- The service models differ only in how much of the stack you still manage.
- Your data and your access control are yours in every model.
- Private cloud means dedicated, not on-premises.
- A VPN over the internet buys confidentiality, not predictable performance.
- Elasticity is the real technical gain; variable cost is the real trade.
- Provider security groups are stateful and subnet ACLs usually are not.
Ready to keep going?
Create a free account to save your progress and take the knowledge check.