How do you choose between IaaS, PaaS, and SaaS when studying for the CV0-004 exam? This topic is about understanding the three main ways cloud services are delivered, and knowing which one suits a given business need. Mastering these distinctions is a core exam objective and essential for any IT professional who will buy, design, or manage cloud systems.
Jump to a section
A simple way to picture Cloud Service Models: IaaS, PaaS, SaaS
Have you ever ordered dinner with friends and had to figure out who does what? Suppose you are organising a pizza night at home. There are three very different ways to make it happen.
First, you could buy all the ingredients yourself: dough, sauce, cheese, toppings, and the oven. You mix, knead, bake, clean up, and control everything. This is like IaaS (Infrastructure as a Service) — the cloud provider gives you the raw computing power, storage, and networking, but you manage the operating system, applications, and data yourself. You have maximum control but maximum work.
Second, you could order a take-and-bake pizza. The shop has prepared the dough, spread the sauce, and added the cheese. You take it home and only need to bake it in your own oven. This is like PaaS (Platform as a Service) — the provider gives you a ready-to-use platform (like a database or development environment), so you focus on building and deploying your application without worrying about the underlying hardware or operating system.
Third, you could just have a pizza delivered to your door, fully cooked and ready to eat. You do not care about the dough recipe, the oven temperature, or the delivery driver's route. This is like SaaS (Software as a Service) — you simply use the software (like Gmail or Salesforce) through your web browser, and the provider handles everything from servers to security.
Cloud service models are the three main categories of services that cloud providers offer. They are IaaS (Infrastructure as a Service), PaaS (Platform as a Service), and SaaS (Software as a Service). Think of them as a spectrum of responsibility: the more the cloud provider does for you, the less you have to manage yourself.
To understand them, start with the traditional on-premises model. Before the cloud, a company that wanted to run a website would have to buy servers, install them in a building, wire up networking, install an operating system, configure security, install the software, and maintain everything 24/7. That is a huge amount of work. Cloud service models let you offload different parts of that work to a provider.
IaaS (Infrastructure as a Service) IaaS gives you the most control and responsibility. The provider gives you virtualised computing resources over the internet — things like virtual machines (VMs), storage, and virtual networks. You still have to install and manage the operating system, middleware, applications, and data. The provider is responsible for the physical hardware, the networking gear, and the physical security of the data centre. Examples include Amazon EC2 (Elastic Compute Cloud), Google Compute Engine, and Microsoft Azure Virtual Machines.
Who uses IaaS? IT administrators who need to run legacy software that requires a specific operating system version, or companies that need to set up complex network configurations. It is the most flexible model but requires the most IT skill.
PaaS (Platform as a Service) PaaS takes the responsibility up one level. The provider gives you a platform that includes the operating system, runtime environment (like a server that runs code), database, and middleware. You just write and deploy your own code. You do not worry about patching the operating system, installing updates, or managing hardware. The provider handles all of that. Examples include Google App Engine, AWS Elastic Beanstalk, and Azure App Services.
PaaS is popular with software developers. They can focus on writing code and shipping features without getting bogged down by server maintenance. The platform automatically handles scaling — if your app gets a million users, the platform adds more resources without you having to manually configure anything.
SaaS (Software as a Service) SaaS is the most hands-off model. The provider gives you a complete, ready-to-use software application that runs in the cloud. You access it through a web browser or a mobile app. You do not control the underlying infrastructure, the platform, or the application code. You just use the software. Examples include Gmail, Google Docs, Microsoft 365, Salesforce, and Zoom.
SaaS is for end users — anyone who needs to get work done without caring about servers or databases. The provider handles everything: maintenance, security patches, data backups, and uptime.
Why this matters for the exam The CV0-004 exam expects you to compare and contrast these three models. You need to understand the key characteristics of each:
IaaS: You manage the OS, middleware, and applications. Provider manages virtualisation, hardware, networking, and physical security.
PaaS: You manage the application and data. Provider manages the OS, middleware, runtime, and infrastructure.
SaaS: You manage nothing except your user account and data entry. Provider manages everything else.
The exam also tests your ability to choose the right model for a given scenario. For example, if a company needs complete control over the operating system for a compliance requirement, IaaS is the answer. If a developer wants to deploy code quickly without managing servers, PaaS is the answer. If a sales team just needs email and document sharing, SaaS is the answer.
Another key distinction is the shared responsibility model. This is a concept every CV0-004 candidate must understand. It shows which security responsibilities belong to the cloud provider and which belong to the customer. In IaaS, the customer is responsible for securing the operating system, applications, and data. In PaaS, the customer secures only the application and data. In SaaS, the customer secures only the data and user access (like strong passwords and multi-factor authentication). The provider secures everything else.
Finally, remember that these models are not just theoretical categories. In real life, hybrid and multi-cloud strategies often combine elements of all three. A company might use IaaS to run a legacy database, PaaS to build a new customer portal, and SaaS for its email and HR systems, all at the same time.
Identify the business requirement
Read the scenario and determine what the customer needs to control and manage. Do they need to install custom software with specific OS requirements? That points to IaaS. Do they need to deploy code without managing servers? That points to PaaS. Do they need a ready-to-use application? That points to SaaS.
Assess the level of control required
The more control the customer needs over the operating system, middleware, and runtime, the lower on the service model stack you go. IaaS offers the most control. PaaS offers moderate control (only over your code and data). SaaS offers the least control (only over your data and user settings).
Evaluate the maintenance capacity of the IT team
If the customer has a small IT team with limited time, they should lean toward PaaS or SaaS to minimise maintenance tasks like patching operating systems and managing physical hardware. If the team is experienced and needs custom configurations, IaaS is appropriate.
Map the responsibility boundaries using the shared responsibility model
Draw a line between what the provider manages and what the customer manages. For IaaS, the customer manages everything above the hypervisor. For PaaS, the customer manages only the application and data. For SaaS, the customer manages only data and access. This step directly matches exam questions.
Select the appropriate cloud service model
Based on the first four steps, choose one model. If the scenario is ambiguous, the exam will include keywords: 'manage the operating system' = IaaS, 'deploy code without managing servers' = PaaS, 'ready-to-use software' = SaaS.
Verify with real-world examples
Check your choice against known services. If you chose IaaS, can you name a specific service like Amazon EC2? If PaaS, like Google App Engine? If SaaS, like Microsoft 365? This mental check helps confirm you have not confused the models.
Imagine you work for a medium-sized retail company called ShopBright. The company sells home goods online and has a small IT team of four people. The leadership wants to modernise the business by moving to the cloud. As the person studying for the CV0-004 exam, you have been asked to recommend which cloud service model to use for different parts of the business.
Step one: Assess the email system ShopBright currently runs its own email server on a physical computer in a back office. It keeps crashing, and the IT team spends hours each week applying security patches. You recommend moving to SaaS — specifically, Microsoft 365. The provider handles all the servers, security, and updates. The IT team just manages user accounts and passwords. This frees up their time for more valuable work.
Step two: Build a new customer loyalty app The marketing team wants a new mobile app for loyalty rewards. The developers want to write code in Python and use a database. They do not want to worry about provisioning servers or patching operating systems. You recommend PaaS — specifically, Azure App Services with a managed PostgreSQL database. The developers push their code to the platform, and the platform automatically handles scaling if the app becomes popular. The IT team does not need to manage any servers.
Step three: Migrate the legacy accounting software ShopBright's accounting software is a custom application that runs on a very specific version of Windows Server. It must run on a particular operating system configuration. You recommend IaaS. You create a virtual machine (VM) in AWS EC2, install the exact version of Windows Server that the accounting software requires, and restore the data from a backup. The cloud provider maintains the physical hardware and the data centre security, but your IT team still has to manage the operating system updates and the application itself.
Step four: Choose a file-sharing service The sales team needs to share large product catalogues with external partners. You evaluate SaaS options like Dropbox Business or Google Workspace. These are ready-to-use file-sharing platforms. You do not need to build anything or manage any infrastructure. You simply buy the subscription and onboard the users.
What the IT professional actually does - For IaaS: The IT professional logs into the cloud console, creates a virtual machine, selects the operating system, configures the firewall rules (also called network security groups), and then secures the operating system by applying updates and setting up user accounts. They might also set up backups and monitoring. - For PaaS: The IT professional sets up the development environment, gives the developers access to the platform, and configures the database connection. They might set up automated deployment pipelines so that code changes are automatically tested and deployed. - For SaaS: The IT professional typically does the initial configuration: setting up single sign-on using Microsoft Entra ID, assigning licences to users, and configuring security policies like multi-factor authentication. After that, day-to-day management is minimal.
The key takeaway from this real-world scenario is that the same company uses all three models for different needs. You do not have to pick just one. The exam expects you to analyse a business requirement and recommend the correct model.
The CV0-004 exam tests 'Cloud Service Models: IaaS, PaaS, SaaS' under objective 1.2. This is a core concept that will almost certainly appear in multiple questions. Here is exactly what you need to know.
Question types you will see - Scenario-based questions: The exam presents a business requirement and asks you to choose the best cloud service model. For example: 'A company needs to deploy a custom application without managing the underlying operating system. Which model should they choose?' The answer is PaaS. A common trap is that beginners choose IaaS because they think 'custom application' means more control, but PaaS is the right choice because the requirement says 'without managing the underlying operating system'. - Comparison questions: The exam might ask you to identify the key difference between two models. For example: 'Which model gives the customer the most control over the operating system?' The answer is IaaS. - Shared responsibility model questions: The exam might describe a security incident and ask who is responsible. For example: 'A customer's data is exposed because the SaaS provider did not patch a vulnerability. Who is responsible?' The answer is the provider.
Traps the exam sets - Trap 1: Confusing IaaS and PaaS on who manages the operating system. Remember: IaaS = you manage the OS. PaaS = the provider manages the OS. - Trap 2: Assuming SaaS gives you any control over the application code. It does not — you cannot modify the code of Gmail or Salesforce. - Trap 3: Thinking that PaaS is only for developers. While developers are the primary users, the exam might describe a scenario where a business analyst needs to deploy a database without managing servers — that is also PaaS (specifically, a managed database service).
Key concepts to memorise - The shared responsibility model: Know what the customer manages vs what the provider manages for each model. - The definition of each model: IaaS = infrastructure only (VMs, storage, networks). PaaS = platform (runtime, database, middleware). SaaS = complete software application. - Examples of each: AWS EC2 (IaaS), AWS Elastic Beanstalk (PaaS), Google Workspace (SaaS).
Exam tips - Read the question carefully. If the scenario mentions the customer needs to install or configure an operating system, the answer is IaaS. - If the scenario mentions developers deploying code without managing servers, the answer is PaaS. - If the scenario mentions end users accessing ready-to-use software through a browser, the answer is SaaS. - Be ready for hybrid scenarios. Some questions might describe a multi-cloud environment where different models are used for different applications. The correct answer will ask you to identify the model for a specific application, not for the whole environment. - Memorise the exact wording of the shared responsibility model: in IaaS, the customer secures the OS and above. In PaaS, the customer secures the application and data. In SaaS, the customer secures only their data and user access.
IaaS gives you raw computing resources like virtual machines and storage, and you manage the operating system and applications yourself.
PaaS provides a ready-to-use development and deployment platform, so you focus on writing code while the provider manages the servers and operating system.
SaaS delivers a complete software application over the internet, so you just log in and use it with no infrastructure or platform management.
The shared responsibility model dictates that the customer's security responsibilities decrease as you move from IaaS to PaaS to SaaS.
A single organisation can and often does use all three models simultaneously for different business needs.
The CV0-004 exam tests your ability to match a business requirement to the correct cloud service model, not just memorise definitions.
These come up on the exam all the time. Here's how to tell them apart.
IaaS
Customer manages the operating system and all software
Customer has full control over virtual machine configuration
Requires significant IT administration skills
PaaS
Provider manages the operating system and runtime
Customer only controls their own application code and data
Designed for developers who want to avoid server management
PaaS
Customer develops and deploys their own code
Customer is responsible for application security and updates
Provider manages the underlying platform and infrastructure
SaaS
Customer simply uses the software as provided
Provider handles all application security and updates
Customer only manages user accounts, data, and access policies
IaaS
Maximum customer control over computing resources
Customer must handle all maintenance and patching
Billed for raw compute, storage, and network usage
SaaS
Minimum customer control — you cannot modify the software
Provider handles all maintenance and patching
Billed per user per month subscription
Mistake
IaaS means I have no responsibility at all because it is in the cloud.
Correct
In IaaS, the customer is responsible for managing the operating system, middleware, applications, and data. The provider only manages the physical hardware, virtualisation, and networking.
People hear 'cloud' and assume the provider does everything. They forget that with IaaS, the customer still has significant administrative work.
Mistake
PaaS is just for hosting websites and is the same as SaaS.
Correct
PaaS provides a platform for developers to build and deploy custom applications. SaaS provides ready-to-use software that end users access, like email. They are completely different — PaaS is a development environment, SaaS is a finished product.
The similarity in names (both end in 'as a Service') makes beginners lump them together. The distinction between building software (PaaS) and using software (SaaS) is critical.
Mistake
You must use only one cloud service model for an entire organisation.
Correct
Organisations commonly use a mix of IaaS, PaaS, and SaaS for different applications and departments. This is called a hybrid or multi-service strategy.
Beginners often think of these models as mutually exclusive, but real-world IT environments combine them based on the specific needs of each workload.
Mistake
In PaaS, the customer is responsible for patching the operating system of the virtual machines.
Correct
In PaaS, the cloud provider manages the operating system, runtime, and middleware. The customer only manages their own application code and data.
This mistake comes from confusing PaaS with IaaS. Because both involve deploying code, beginners assume the same level of control and responsibility applies.
Mistake
SaaS means the provider has full control and the customer has no security responsibility at all.
Correct
The customer is still responsible for securing their own data, managing user access (e.g., using strong passwords and multi-factor authentication), and configuring permissions through tools like Microsoft Entra ID.
The word 'software as a service' makes people think the provider handles everything, but data security and user management always remain a shared responsibility.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
IaaS gives you virtual machines, storage, and networking that you manage yourself. PaaS gives you a ready-to-use platform (like a database or application server) so you only need to deploy your code. In IaaS, you manage the operating system. In PaaS, the provider does.
No, you still need an IT team to manage user accounts, configure security policies (like multi-factor authentication), handle data governance, and manage subscriptions through services like Microsoft Entra ID.
Yes, that is a perfect use case for IaaS. You create a virtual machine with the exact operating system version required, install the legacy application, and the cloud provider handles the physical hardware.
The cloud provider is responsible for patching the operating system, runtime, and middleware. The customer is responsible for securing their own application code and ensuring their data is properly configured.
IaaS: Amazon EC2. PaaS: AWS Elastic Beanstalk or Google App Engine. SaaS: Gmail or Microsoft 365. Remember these specific examples for exam questions.
In IaaS, the customer manages the OS, apps, and data. In PaaS, the customer manages only the app and data. In SaaS, the customer manages only the data and user access. The provider manages everything else at each level.
You've finished Cloud Service Models: IaaS, PaaS, SaaS. Continue through the CV0-004 study guide to build a complete picture of the exam.
Done with this chapter?