CV0-004 objective 1.3 asks you to compare and contrast different deployment models. You need to understand who owns the infrastructure, who controls security, and how much work you have to do yourself. This is the foundation for every cloud decision you will make on the job.
Jump to a section
A simple way to picture Cloud Deployment Models and Shared Responsibility
You are a landlord named Alex who owns a flat in a large building. You decide to rent it out to a tenant named Sam.
Your responsibility as Alex is to maintain the building's structure — the roof, the walls, the lifts, and the plumbing that runs inside the walls. You must ensure the property meets safety regulations and that the main water and electricity supplies work. You own the building and you are responsible for what is inside the shared walls.
Sam, the tenant, is responsible for what happens inside the flat. Sam can rearrange the furniture, install a new curtain rail, and decide which devices to plug into the sockets. Sam is also responsible for keeping the flat clean, changing the lightbulbs, and paying for the electricity they use inside the flat. However, if the boiler in the basement breaks, Sam cannot fix it — that is your responsibility as the landlord.
Now imagine you own the entire building and you also live in it. You are the sole occupant. You handle everything from fixing the boiler to decorating the living room. This is like a private cloud — one organisation owns and manages everything.
But what if you own only part of the building? You own the second floor and the ground floor is owned by a different landlord who shares the roof and main plumbing with you. This is a hybrid deployment — some parts are yours and managed by you, and other parts belong to someone else but still serve the same building.
This everyday rental scenario maps directly to cloud deployment models. The shared responsibility model is about who manages what. In the cloud, the provider (the landlord) manages the physical infrastructure, while the customer (the tenant) manages what they put inside and how they configure it. Different deployment models change where the boundaries of responsibility lie.
Cloud deployment models are the different ways you can set up and use cloud computing resources. Think of them as different living arrangements for your data and applications. The four main models you need to know for CV0-004 are public cloud, private cloud, hybrid cloud, and community cloud.
First, the public cloud. This is the model where a third-party provider, like Amazon Web Services (AWS), Microsoft Azure, or Google Cloud Platform (GCP), owns and manages the entire infrastructure. You access resources like virtual machines, storage, and databases over the internet. You pay only for what you use, just like paying a water bill. The provider handles the physical servers, networking, cooling, and security of the data centres. You are responsible for what you put on those resources — your data, your applications, and your access controls. This is the most common model for startups and small businesses because it requires very little upfront investment.
Second, the private cloud. Here, the infrastructure is used exclusively by one organisation. It can be physically located in your own data centre (on-premises) or hosted by a third party, but it is dedicated entirely to you. Only your employees and systems can access it. This gives you complete control over security, compliance, and performance. The trade-off is that you pay for everything yourself — hardware, software, staff, power, and cooling. Private cloud is often used by banks, government agencies, and healthcare organisations that have strict regulatory requirements.
Third, the hybrid cloud. This combines public and private clouds, allowing data and applications to move between them. For example, you might run your core banking system on a private cloud for security, but use the public cloud to handle seasonal traffic spikes for your customer-facing app. The key benefit is flexibility. You keep sensitive data on your own infrastructure while using the public cloud for burst workloads. The challenge is that you must manage connectivity, security, and consistent policies across both environments.
Fourth, the community cloud. This is a shared infrastructure used by several organisations that have common concerns, such as compliance, security, or policy requirements. For example, several hospitals in a region might share a community cloud to store patient records. The cloud is owned and managed by one or more of the organisations, or by a third party. It gives you some benefits of a private cloud (control, security) but spreads the cost across multiple tenants.
Now let us talk about the shared responsibility model. This defines who is responsible for what in the cloud. The provider is always responsible for the security of the cloud — the physical data centres, networking hardware, hypervisors, and the underlying infrastructure. The customer is responsible for security in the cloud — the data they store, the configurations they apply, access controls, and the applications they run.
The exact split depends on the service model. In Infrastructure as a Service (IaaS), the customer manages everything above the hypervisor: operating systems, applications, data, and network controls. In Platform as a Service (PaaS), the provider manages the operating system and runtime environment, so the customer only worries about their code and data. In Software as a Service (SaaS), the provider manages everything except the customer's data and user access.
Why does this matter? Because choosing a deployment model affects cost, control, compliance, and complexity. A public cloud is cheap to start but offers less control. A private cloud offers full control but costs more. A hybrid cloud gives you the best of both worlds but adds management overhead. Community cloud is a middle ground. The CV0-004 exam will ask you to compare these models based on attributes like cost, scalability, control, and security.
Identify workload requirements
Before choosing a deployment model, you analyse the workload. What are the compliance needs? How sensitive is the data? How much does the usage fluctuate? This step determines whether you need full control (private) or can use shared infrastructure (public).
Evaluate cost and budget
You calculate the total cost of ownership (TCO) for each model. Public cloud has low upfront costs but recurring operational expenses. Private cloud requires capital investment in hardware. Hybrid cloud adds costs for connectivity and management tools. This step often rules out some models.
Assess compliance and regulatory constraints
If your data must stay within a specific country or meet industry standards (e.g., HIPAA, GDPR), you check whether each deployment model can meet those requirements. Private cloud or community cloud often win for strict compliance, but some public clouds offer compliant regions too.
Design the architecture
For a hybrid cloud, you design how public and private environments will connect — typically through a VPN or direct connection like Azure ExpressRoute or AWS Direct Connect. You also decide which workloads run where and how data will be synchronised.
Define the shared responsibility boundary
You document exactly who manages each layer: physical security, network, hypervisor, operating system, middleware, application, data, and access. This is crucial for security audits and for avoiding gaps where nobody is responsible.
Implement and test the deployment
You provision resources in the chosen environment(s), configure security groups, set up monitoring, and verify that the shared responsibility model is working. For a hybrid cloud, you test that data can move securely between the two environments.
Meet Priya, an IT manager at a mid-sized healthcare company called MedCore Health. MedCore develops a patient portal that lets patients book appointments and view test results. They also store highly sensitive medical records that must comply with HIPAA (the US health data privacy law).
Priya needs to decide how to deploy the patient portal. Her first thought is the public cloud because it is fast to set up and scales easily. She signs up for AWS and launches the portal on virtual machines (IaaS). The provider manages the data centre, but Priya's team must harden the operating system, apply patches, configure firewalls, manage user identities, and encrypt the data at rest and in transit. They follow the shared responsibility model: the provider secures the physical infrastructure, they secure everything inside.
However, MedCore's medical record system is another story. It contains protected health information (PHI). Priya decides to run this on a private cloud within MedCore's own data centre. They buy servers, install a hypervisor, and keep everything behind their own firewall. This gives them complete control over who can physically access the servers and ensures compliance with HIPAA. The downside is that they had to spend 500,000 dollars upfront on hardware and hire two extra engineers to manage it.
A few months later, the patient portal becomes wildly popular. During flu season, traffic spikes tenfold. The public cloud handles this automatically — Priya enabled auto-scaling, so AWS spins up more virtual machines as needed. She pays only for the extra capacity during peak times. The private cloud cannot do this because MedCore owns a fixed amount of hardware. If they hit capacity, they cannot add servers instantly.
Priya realises she needs a way to use the public cloud for bursting without moving the medical records there. She builds a hybrid cloud. She keeps the medical records on the private cloud, but uses the public cloud during peak loads for less sensitive workloads, like appointment booking. The two environments are connected via a secure VPN (Virtual Private Network). Now she has the best of both worlds: security for sensitive data and elasticity for demand spikes.
Priya also joins a community cloud project with two other regional hospitals. They share a common infrastructure for running analytics on anonymised patient data. This reduces costs for each hospital because they share the hardware and management overhead.
What does Priya actually do day to day? - She evaluates each workload's security and compliance requirements before choosing a deployment model. - She writes policies that define who is responsible for patching, monitoring, and access control in each environment. - She monitors the cost of the public cloud and compares it to the cost of maintaining the private cloud. - She ensures the VPN link between the public and private clouds is always up and encrypted. - She conducts security audits to verify that the shared responsibility model is being followed correctly. - She regularly trains her team on the differences between IaaS, PaaS, and SaaS responsibilities.
The CV0-004 exam tests your ability to compare and contrast deployment models. You will see multiple-choice questions that present a scenario and ask you to pick the right model. The exam loves to test the following concepts:
The definitions of public, private, hybrid, and community cloud. You must know them cold.
The shared responsibility model and how it changes across IaaS, PaaS, and SaaS.
The trade-offs: for example, a private cloud offers the most control but the highest upfront cost. A public cloud offers the lowest upfront cost but less control over the environment.
Hybrid cloud use cases: test questions often describe a company that needs to keep sensitive data on-premises but wants to use public cloud for burst capacity. The correct answer is hybrid cloud.
Community cloud use cases: a question might describe several organisations in the same industry that share a cloud to meet common compliance requirements.
Common traps the exam sets:
They describe a private cloud but say it is managed by a third party. That is still a private cloud if it is dedicated to one customer. Do not confuse it with public cloud just because a third party manages it.
They list multiple benefits of a private cloud (control, compliance, performance) and then ask for the primary disadvantage. The answer is high cost and limited scalability.
They describe a hybrid cloud but the two environments are not connected. That is not hybrid cloud — it is two separate clouds with no data sharing or orchestration between them. Hybrid requires connectivity.
They describe a company that uses only public cloud, but the question says they must meet a specific compliance requirement that demands full control over the physical hardware. The correct answer is private cloud or on-premises, not public.
Concepts to memorise for the exam:
Public cloud: shared infrastructure, pay-as-you-go, low upfront cost, limited control.
Private cloud: dedicated to one organisation, full control, high cost, limited scalability.
Hybrid cloud: combination of public and private with connectivity, provides flexibility and bursting.
Community cloud: shared among organisations with common goals, cost is split, control is shared.
Shared responsibility: provider secures the cloud, customer secures in the cloud.
Service models: IaaS (you manage OS and up), PaaS (you manage code and data), SaaS (you manage data and users).
Question types you will see:
Scenario-based: "A hospital needs to store patient records and must comply with government regulations. It also needs to handle sudden spikes in appointment scheduling. Which deployment model is best?"
Definition: "Which cloud deployment model is characterised by infrastructure that is shared among multiple organisations with a common goal?"
Comparison: "What is a key difference between public and private cloud?"
Shared responsibility: "In a PaaS model, who is responsible for patching the operating system?"
There are four main cloud deployment models: public, private, hybrid, and community, each with different ownership, control, and cost structures.
The shared responsibility model means the cloud provider secures the infrastructure, and you secure your data, applications, and configurations.
A private cloud is dedicated to a single organisation and can be located on-premises or hosted by a third party.
Hybrid cloud requires a connection (such as a VPN or dedicated link) between public and private environments so data and workloads can move between them.
Community cloud is used by several organisations with common compliance or security goals, sharing the cost and management.
In a public cloud, you pay only for what you use and can scale up or down instantly, but you have less control over the physical infrastructure.
These come up on the exam all the time. Here's how to tell them apart.
Public Cloud
Infrastructure is shared among multiple tenants
Low upfront capital expenditure
Scalability is virtually unlimited and automatic
Private Cloud
Infrastructure is dedicated to one organisation
High upfront capital expenditure
Scalability is limited by owned hardware
Hybrid Cloud
Combines public and private cloud
Environments are connected (e.g., VPN)
Allows workload portability between on-prem and cloud
Multi-Cloud
Uses multiple public cloud providers
Environments may or may not be connected
Focuses on avoiding vendor lock-in
Community Cloud
Shared by organisations with common goals
Costs are shared among members
Higher level of control and compliance than public cloud
Public Cloud
Open to any paying customer
Costs are individual pay-as-you-go
Less control over physical infrastructure
Mistake
A private cloud means the hardware is physically in my building.
Correct
A private cloud can be hosted on-premises or off-premises by a third party. What makes it private is that it is dedicated to a single organisation, not that it is in your building.
People think 'private' means 'physically owned and located here', but it actually refers to exclusive access, not location.
Mistake
Hybrid cloud means using two different public cloud providers at the same time.
Correct
Hybrid cloud specifically refers to a mix of public and private cloud that are connected and work together. Using two public clouds is called multi-cloud, not hybrid cloud.
The word 'hybrid' makes people think 'mix of anything', but the exam defines it strictly as public plus private.
Mistake
In a public cloud, the provider is responsible for everything, including my data.
Correct
In the shared responsibility model, you are always responsible for your own data, regardless of the service model. The provider secures the infrastructure, but you must protect your data through encryption, access controls, and backups.
Beginners assume 'managed by provider' means 'provider handles everything', but security is always a shared duty.
Mistake
Community cloud is the same as a private cloud that is shared with partners.
Correct
Community cloud is shared by a group of organisations with common interests (like compliance or industry), but it is a distinct deployment model, not just a shared private cloud. The ownership and management structure is different.
People confuse 'shared' with 'private cloud shared with a few people'. The exam treats community cloud as its own model with specific characteristics.
Mistake
On-premises infrastructure and private cloud are the same thing.
Correct
On-premises means the hardware is physically in your building, but it may not have cloud characteristics like self-service, automated provisioning, or elastic scaling. True private cloud includes cloud-like features such as a hypervisor and orchestration.
The term 'on-premises' is often used loosely. The exam requires you to distinguish between traditional on-premises and actual private cloud.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Public cloud infrastructure is shared among multiple customers and managed by a third-party provider. Private cloud is dedicated to a single organisation and can be hosted on-premises or by a third party, giving you full control.
No. Hybrid cloud combines public and private cloud with connectivity between them. Multi-cloud means using multiple public cloud providers (e.g., AWS and Azure) but not necessarily a private cloud.
In IaaS, you are responsible for patching the operating system because the provider only manages the hypervisor and below. In PaaS, the provider patches the OS for you.
When multiple organisations in the same industry (like hospitals or government agencies) need to share infrastructure to meet common compliance requirements and reduce costs.
Yes. A private cloud is defined by being dedicated to a single organisation, not by its physical location. A third-party provider can host it on their premises as long as the infrastructure is not shared with other customers.
The shared responsibility model mostly depends on the service model (IaaS, PaaS, SaaS), not the deployment model. However, in a private cloud, you may have more responsibility because you own the hardware.
You've finished Cloud Deployment Models and Shared Responsibility. Continue through the CV0-004 study guide to build a complete picture of the exam.
Done with this chapter?