Classify cloud services, locate the operational boundary, and prove the controls that remain with the customer.
50 min 120 XPSkills: Cloud classification, Responsibility mapping, Customer evidence
Brief
Halcyon Clinics moves its appointment portal from rented virtual machines to a managed application platform. The operations lead deletes the guest operating-system patch job, then proposes deleting access reviews too: 'The provider now owns security.' During the next review, a former receptionist still has permission to export patient appointments. The migration changed who maintains the runtime, not who authorises clinic staff.
You will separate three questions that procurement has bundled together: does the service meet the cloud definition, which service and deployment models describe it, and who operates each control? A provider assurance report can support inherited physical security; it cannot demonstrate that Halcyon removed its own departing users. Build a responsibility map before deciding which evidence collectors to retire.
A managed service moves an operational boundary; it does not transfer the customer's accountability for its data and use of the service.
Five characteristics, not a hosting label
NIST SP 800-145 defines five essential characteristics. On-demand self-service means a consumer provisions capabilities without human interaction with each service provider. Broad network access means standard network mechanisms support heterogeneous clients, not that every resource is publicly reachable. Resource pooling means provider resources serve multiple consumers with dynamic assignment and location independence at the resource level; a consumer may still select a country or region. A remotely accessed server does not satisfy all five just because it has an internet address.
Rapid elasticity means capacity can expand and contract with demand, sometimes automatically. Measured service means resource use is metered, monitored, controlled and reported at an appropriate level, such as storage capacity or active accounts; it does not require per-second billing. If 4 workers grow to 20 for a queue spike and return to 4, that is elasticity. A usage report showing 640 worker-hours is metering. A fixed monthly invoice alone proves neither.
For procurement classification, retain provisioning records, scaling events and usage reports alongside the service description. Ask: can a consumer allocate capacity without a manual provider ticket, and what records demonstrate expansion and release? This supports an accurate service inventory and prevents treating conventional outsourced hosting as cloud merely because a sales sheet uses that word.
Provisioning, scaling and metering are distinct properties with distinct evidence.
Service models locate the maintenance boundary
Infrastructure as a Service (IaaS) exposes processing, storage and networking so customers can deploy operating systems and applications. The provider normally operates facilities, physical hosts and the virtualisation layer; the customer patches guest operating systems, maintains applications, configures permitted network controls and manages identities and data. A provider host-patching record does not close a finding about an unpatched guest kernel.
Platform as a Service (PaaS) lets the customer deploy applications using supported languages, libraries and tools while the provider operates the underlying infrastructure, operating system and managed runtime. The customer still maintains its application code, packaged dependencies, secrets, access and exposed configuration. Software as a Service (SaaS) provides the application itself; the provider maintains that application stack, but the customer still controls users, tenant settings, data handling and permitted integrations. A managed runtime does not imply the provider fixes a vulnerable library bundled inside customer code.
These are baselines, not universal contracts. For each service, record the exact component, provider obligation, customer action and evidence source. Check service documentation for backup scope, supported runtime versions and log availability. Ask an auditor's concrete question: who patches this component, on what schedule, and where is completion recorded? Customer accountability includes checking that inherited controls cover the service actually used.
Provider maintenance grows across service models while customer access and data obligations remain.
Deployment models describe the community, not the patch owner
A private cloud is provisioned for exclusive use by one organisation, potentially including several business units; it may be operated by that organisation or a third party, on or off premises. A community cloud is for exclusive use by organisations sharing concerns such as mission, security or compliance requirements. A public cloud is provisioned for open use by the general public. Public describes the eligible consumer population, not a requirement to publish customer records or expose every workload to the internet.
A hybrid cloud combines two or more distinct private, community or public clouds that remain unique entities but are bound by technology enabling data and application portability. Two unrelated public subscriptions are not automatically a hybrid cloud. Nor does connecting an ordinary office server to a public cloud necessarily create one: both constituent environments must qualify as clouds. Service and deployment models are independent axes, so an exclusive-use environment can deliver SaaS, and a public environment can deliver IaaS.
Record deployment rationale, data flows and contractual location commitments for jurisdiction and segregation controls. A three-hospital community cloud may restrict membership while still requiring each hospital to review its own staff permissions. Ask which organisations may consume the service and how any portability link works; a network address or a 'private' marketing label is insufficient classification evidence.
Evidence that stays on the customer's desk
Build an evidence matrix by service and control rather than attaching one provider report to every requirement. For account lifecycle controls, keep the tenant user population, dated review decisions and removal logs. For configuration controls, keep tenant-specific exports showing restrictions on external sharing, privileged authentication and audit logging. Include service and tenant identifiers, collection time and the review period; an undated screenshot of a default setting cannot prove that a production tenant enforced it throughout a quarter.
For resilience, compare contractual backup and retention terms with the customer's required recovery point and recovery time objectives. Keep restore or export recovery tests for the mechanisms the customer must operate; a provider availability target is not a promise that an accidentally deleted record can be recovered. For provider-operated controls, inspect assurance scope, period, exceptions and stated customer responsibilities, then document how gaps are handled. The auditor asks both 'What can you inherit?' and 'What did you do to make that inheritance valid here?'
Tasks
Answers are graded on the server: the answer key never reaches your browser.
Task 1: The usage meter called a scaling engine
Scenario sim+40 XP
Read the brief and answer both questions.
Incident brief
Halcyon's queue workers rise from 4 to 20 during a surge and return to 4 afterwards. A separate service records worker-hours and publishes consumption totals. The finance lead calls the totals 'elasticity' and the changing worker count 'billing'. Neither label describes the mechanism correctly.
1.1Which essential characteristic describes the expansion and contraction? (two words)
1.2Which essential characteristic describes metering and reporting consumption? (two words)
Task 2: Private does not mean a virtual machine
Scenario sim+40 XP
Read the brief and answer both questions.
Incident brief
A service is reserved exclusively for Halcyon Clinics. The provider manages the operating system and runtime, while Halcyon uploads application code and maintains bundled dependencies. Procurement calls it 'IaaS because it is private'. There is no guest operating system for Halcyon to administer.
Term bank, not all of these are right
PaaSIaaSprivate cloudpublic cloud
2.1Which service model matches the described maintenance boundary? (an acronym)
2.2Which deployment model matches the exclusive organisational use? (two words)
Task 3: The report that supposedly removed users
Scenario sim+40 XP
Read the brief and answer both questions.
Incident brief
Halcyon consumes a finished scheduling application in a browser and cannot deploy its own application code. The service owner labels it 'PaaS because it has settings'. A provider assurance report covers physical host security. The owner says that report also proves former staff were removed, although Halcyon alone approves and revokes tenant accounts.
Term bank, not all of these are right
SaaSPaaScustomerprovider
3.1Which service model supplies the finished application? (an acronym)
3.2Which party must evidence the tenant account removal in this arrangement? (one word)
Labs
80 bonus XP
Hands-on work. You edit the artefact, the server runs the checks: the expectations and the reference solution never reach your browser.
Halcyon deploys its own portal code onto a managed runtime. The migration note calls the destination 'SaaS' and marks all controls inherited. The contract actually assigns the operating system and runtime to the provider, while Halcyon maintains application dependencies and tenant accounts.
Complete the map using the fixture, not the migration note. Use customer or provider for owner fields. Name a concrete customer access-review artefact and record whether the provider report alone proves that control. Retain the required review cadence as a number of days.
Contract extract and internal control requirement
service: consumer deploys portal code; provider operates OS and runtime
use: exclusive to Halcyon Clinics
application_dependencies: consumer patches libraries bundled with portal
accounts: consumer approves and revokes tenant access
access_review: every 90 days; retain dated decisions or a dated signed user review
provider_report: physical facilities and managed runtime controls only
migration_note: SaaS; everything inherited
1
2
3
4
5
6
7
8
9
10
11
12
Checks
Service model follows the code deployment boundary
Deployment model follows exclusive use
Operating-system maintenance follows the contract
Dependencies and tenant access keep explicit owners
Customer evidence records a dated access decision
Cadence and assurance limits match the requirement
The migration lead wants six statements accepted into the assurance pack. She argues that public means exposed and managed means no customer evidence. Judge each statement on the stated facts, not her shorthand.
Accept technically sound statements. Reject each incorrect statement using the single applicable reason code: characteristic-confusion, deployment-confusion, ownership-error, or evidence-gap.
Verdicts are accept or reject. Every rejection needs one reason code from: characteristic-confusion | deployment-confusion | ownership-error | evidence-gap.
Proposed handover statements
CC-1 Metered storage consumption demonstrates measured service, not by itself rapid elasticity.
CC-2 A public cloud deployment means every customer record must be publicly readable.
CC-3 In IaaS the provider patches the customer's guest OS merely because it owns the physical host.
CC-4 For SaaS tenant offboarding operated solely by the customer, a facilities-only provider report is sufficient evidence of removal.
CC-5 A PaaS customer still maintains vulnerable dependencies bundled in its own deployed application under the stated contract.
CC-6 A private cloud may be operated off premises by a third party for one organisation's exclusive use.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
Checks
Every line in the fixture carries a verdict
Accept and reject land on the right lines
Each rejection cites a valid reason code
Next on your path · Cloud Fundamentals
Compute Building Blocks
Locate compute isolation boundaries and preserve deployment evidence after workloads disappear.
