# Cloud Computing Concepts and Architecture

> Chapter 1 of the Courseiva ISC2-CCSP curriculum — https://courseiva.com/learn/isc2-ccsp/cloud-computing-concepts-and-architecture

**Official objective:** 1.1 — Describe cloud computing concepts and reference architecture

## Introduction

Cloud computing replaces the old model where every company had to buy, rack, cable, and maintain its own physical servers in a dusty room. For the CCSP exam, you must understand the core concepts of cloud computing and the reference architecture that defines how cloud services are structured and delivered to customers.

## The Shared Apartment Building Analogy

A shared apartment building is a perfect analogy for cloud computing. The building itself is the cloud provider's data centre — a massive structure that houses dozens of individual apartments, each representing a tenant's virtual environment. The landlord owns the entire building, maintains the roof, the plumbing, the electrical wiring, the lifts, and the security system. Tenants never worry about replacing a boiler or fixing a leaky pipe in the building's core; they simply pay rent and enjoy the benefit of a functioning home.

Inside each apartment, tenants have their own space. They can rearrange furniture, install shelves, paint a wall (within reason), and control their own environment. This is like the tenant managing their own virtual machines, operating systems, and applications. Some apartments are furnished — like Software as a Service (SaaS), where the landlord provides everything down to the cutlery. Others are bare shells — like Infrastructure as a Service (IaaS), where the tenant brings all their own furniture. The landlord provides the building's shared resources: electricity, water, internet connections, and waste disposal. These map to the cloud's pooled compute, storage, and networking resources. When one apartment throws a party and uses more electricity, the building's total capacity absorbs the spike. That's elastic scaling — the cloud's ability to expand or contract resources on demand. If a tenant moves out, their apartment is cleaned, disinfected, and made ready for the next tenant. That's virtualisation and rapid provisioning — the cloud reclaiming idle resources and handing them to the next customer instantly. The building's security team patrols the lobby and monitors cameras. That's shared responsibility — the cloud provider secures the physical infrastructure, while each tenant locks their own door and chooses not to leave valuables on the balcony.

## Core explanation

Cloud computing is a model for enabling on-demand network access to a shared pool of configurable computing resources. Let's unpack that dense definition word by word.

'On-demand' means you can provision resources — virtual machines, storage, databases — whenever you want, without human interaction with the service provider. You click a button in a web portal or run an API call, and seconds later you have a server. 'Network access' means these resources are available over the internet or a private network. They are not local to your machine; they live somewhere else. 'Shared pool of configurable computing resources' means the provider pools together compute (CPU power), storage (hard drives), memory (RAM), and networking (routers, switches) and dynamically assigns them to customers as needed. 'Configurable' means you can control aspects like CPU speed, amount of RAM, and disk size. 'Resources' is the umbrella term for everything IT infrastructure: servers, storage, databases, networking, software, and analytics.

Cloud computing is defined by five essential characteristics, as described by the National Institute of Standards and Technology (NIST). These five characteristics are the bedrock of the CCSP exam.

- On-demand self-service: A consumer can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each service provider.
- Broad network access: Capabilities are available over the network and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, tablets, laptops, and workstations).
- Resource pooling: The provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned according to consumer demand. There is a sense of location independence in that the customer generally has no control or knowledge over the exact location of the provided resources but may be able to specify location at a higher level of abstraction (e.g., country, state, or datacentre).
- Rapid elasticity: Capabilities can be elastically provisioned and released, in some cases automatically, to scale rapidly outward and inward commensurate with demand. To the consumer, the capabilities available for provisioning often appear to be unlimited and can be appropriated in any quantity at any time.
- Measured service: Cloud systems automatically control and optimise resource use by leveraging a metering capability at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency for both the provider and consumer of the utilised service.

Beyond these five characteristics, the NIST definition also specifies three service models and four deployment models.

The three service models are:
- Infrastructure as a Service (IaaS): The provider offers virtualised computing resources over the internet. You get virtual machines, storage, and networks, but you manage the operating system, middleware, and applications. Think of it as renting a bare plot of land — you build your own house.
- Platform as a Service (PaaS): The provider offers a platform including operating system, runtime environment, database, and web server. You just deploy your own applications. Think of it as renting a prefabricated house — you move in and arrange the furniture.
- Software as a Service (SaaS): The provider offers complete, ready-to-use applications over the internet. You just log in and use it. Think of it as renting a fully furnished hotel room — everything is provided.

The four deployment models are:
- Public cloud: The infrastructure is provisioned for open use by the general public. It exists on the premises of the cloud provider (e.g., AWS, Microsoft Azure, Google Cloud).
- Private cloud: The infrastructure is provisioned for exclusive use by a single organisation comprising multiple consumers. It may be owned, managed, and operated by the organisation, a third party, or some combination of them, and it may exist on or off premises.
- Community cloud: The infrastructure is provisioned for exclusive use by a specific community of consumers from organisations that have shared concerns (e.g., mission, security requirements, policy, and compliance considerations).
- Hybrid cloud: The infrastructure is a composition of two or more distinct cloud infrastructures (private, community, or public) that remain unique entities but are bound together by standardised or proprietary technology that enables data and application portability.

The cloud computing reference architecture, defined by NIST, identifies five major actors: the cloud consumer, the cloud provider, the cloud auditor, the cloud broker, and the cloud carrier. The cloud consumer is the person or organisation that maintains a business relationship with and uses service from a cloud provider. The cloud provider is the person, organisation, or entity responsible for making a service available to interested parties. The cloud auditor is a party that can conduct an independent assessment of cloud services, information system operations, performance, and security of the cloud implementation. The cloud broker is an entity that manages the use, performance, and delivery of cloud services and negotiates relationships between providers and consumers. The cloud carrier is the intermediary that provides connectivity and transport of cloud services from providers to consumers.

These actors interact through service orchestration, which is the arrangement and coordination of automated tasks resulting in a consolidated process or workflow. The reference architecture also includes cloud service management, which comprises the business support, provisioning and configuration, and portability and interoperability layers. Understanding this architecture helps professionals design cloud systems that are secure, compliant, and efficient.

## Real-world context

An IT professional working at a mid-sized retail company called 'ShopGlobal' needs to move the company's customer-facing e-commerce application to the cloud. Here is what that process looks like step by step.

First, the IT professional — let's call her Priya — analyses the current on-premises setup. The company runs web servers, a database server, and a payment processing server in a small server room. The servers are five years old, and the room is running out of power and cooling capacity. Priya gathers requirements: the application must handle 10,000 concurrent users during peak holiday shopping, it must be available 99.99% of the time, and it must comply with Payment Card Industry Data Security Standard (PCI DSS) because it processes credit cards.

Priya then selects a cloud service model. She decides on a mix of IaaS and PaaS. She will use IaaS for the web servers because the development team wants full control over the operating system and web server software. She will use PaaS for the database because the team does not want to manage database patches and backups. She will use SaaS for email marketing tools and office productivity. She picks a cloud provider — AWS — and signs up for an account.

Next, Priya plans the network architecture. She creates a Virtual Private Cloud (VPC) — a logically isolated section of the AWS cloud where she defines an IP address range, subnets, route tables, and internet gateways. She places the web servers in a public subnet (accessible from the internet) and the database servers in a private subnet (not directly accessible from the internet). She configures security groups — virtual firewalls — to control inbound and outbound traffic. For example, she allows HTTP (port 80) and HTTPS (port 443) traffic from the internet to the web servers, and she allows only the web servers to connect to the database servers on port 3306 (MySQL).

Priya then provisions the compute resources. She launches EC2 instances (virtual machines) for the web servers, choosing an instance type with enough CPU and memory to handle the expected load. She attaches Elastic Block Store (EBS) volumes for persistent storage. She configures an Auto Scaling group so that if CPU utilisation goes above 70%, new instances are automatically launched. She sets a minimum of two instances (for high availability) and a maximum of ten (to handle peak load). She also deploys an Elastic Load Balancer (ELB) that distributes incoming traffic across the healthy web server instances.

For the database, she provisions an Amazon RDS (Relational Database Service) instance — a managed database service. She chooses MySQL as the database engine, configures automated backups, and enables multi-AZ deployment (the database runs in two separate data centres for failover). She does not need to patch the database operating system or manage storage scaling because AWS handles that.

Once the infrastructure is running, Priya sets up monitoring and logging. She uses Amazon CloudWatch to track metrics like CPU utilisation, network throughput, and database connections. She sets alarms that send an SMS or email when metrics cross thresholds (e.g., CPU utilisation above 90% for five minutes). She enables AWS CloudTrail to log all API calls made to the account for security auditing.

Finally, Priya implements security controls. She creates IAM (Identity and Access Management) roles and policies to grant the web server instances permission to access only the needed AWS services (e.g., write logs to CloudWatch). She encrypts data at rest using AWS Key Management Service (KMS) and encrypts data in transit using TLS certificates. She runs vulnerability scans using Amazon Inspector and reviews the configuration against CIS benchmarks. She documents everything for the compliance audit.

When the holiday shopping season arrives, the application experiences a traffic spike. The Auto Scaling group kicks in, launching five additional web server instances. The Elastic Load Balancer distributes traffic smoothly. The database handles the increased query load without issues because Priya had configured read replicas. The customer-facing website remains fast and available. After the peak, Priya reduces the maximum instances to save costs. This entire process — from planning to scaling to cost optimisation — is what an IT professional does with cloud computing concepts in the real world.

## Exam focus

The CCSP exam tests Cloud Computing Concepts and Architecture (Objective 1.1) heavily. Expect around 10–15% of the exam questions to come from this domain. The exam loves the NIST definitions. You will see questions asking: 'Which of the following is NOT one of the five essential characteristics of cloud computing?' or 'Which service model provides the consumer with the least control?' The trap is that the exam offers plausible-sounding characteristics that are not in the NIST definition. For example, 'Pay-per-use' sounds like 'Measured Service' but pay-per-use is a billing model, not the same as metering and optimisation. Memorise the five essential characteristics exactly: On-demand self-service, Broad network access, Resource pooling, Rapid elasticity, Measured service. Know them by heart.

The exam also tests the three service models (IaaS, PaaS, SaaS) and the four deployment models (Public, Private, Community, Hybrid). You will get scenario-based questions: 'A hospital wants a cloud deployment shared with other hospitals for compliance reasons. Which deployment model fits?' Answer: Community cloud. 'A startup wants to avoid all server management and just use a CRM application. Which service model?' Answer: SaaS. A common trap is that the exam uses the term 'Virtual Private Cloud' (VPC) as a distractor — VPC is a networking feature within a public cloud, not a deployment model.

Key definitions to memorise:
- Cloud computing: A model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources that can be rapidly provisioned and released with minimal management effort or service provider interaction.
- Resource pooling: The provider's computing resources are pooled to serve multiple consumers using a multi-tenant model.
- Rapid elasticity: Capabilities can be elastically provisioned and released, in some cases automatically, to scale rapidly outward and inward commensurate with demand.
- Measured service: Cloud systems automatically control and optimise resource use by leveraging a metering capability.

The exam also expects you to know the five major actors in the NIST cloud computing reference architecture: Cloud Consumer, Cloud Provider, Cloud Auditor, Cloud Broker, Cloud Carrier. You will see a question like: 'Which actor manages the use, performance, and delivery of cloud services and negotiates relationships between providers and consumers?' Answer: Cloud Broker. Be careful: the exam might list 'Cloud Vendor' or 'Cloud Reseller' as distractors — those are not in the NIST definition.

Another important concept is the shared responsibility model. The exam will ask who is responsible for what in each service model. For IaaS, the consumer manages the operating system, applications, and data; the provider manages the virtualisation layer, physical hardware, and network. For PaaS, the consumer manages only the applications and data; the provider manages everything below. For SaaS, the provider manages everything, and the consumer only uses the software. The trap is that beginners think the provider is responsible for everything in IaaS — that is wrong.

Finally, the exam tests your understanding of multi-tenancy. Multi-tenancy means that a single instance of software or infrastructure serves multiple tenants (customers). It is a fundamental enabler of resource pooling and cost efficiency. The exam might ask: 'What is the primary benefit of multi-tenancy in cloud computing?' Answer: Efficient use of resources through sharing. The trap is confusing multi-tenancy with virtualisation — virtualisation enables multi-tenancy but is not the same thing.

To prepare, write out the NIST definitions from memory, draw the reference architecture diagram, and practise identifying which service model or deployment model fits a given scenario. Use flashcards for the five characteristics, three service models, four deployment models, and five actors. Those are your highest-yield areas for this objective.

## Step by step

1. **Identify Business Requirements** — The first step in adopting cloud computing is to understand the business goals: why move to the cloud? Common reasons include cost savings, scalability, disaster recovery, and access to advanced technologies like AI and machine learning. You also gather technical requirements like expected user load, latency needs, compliance regulations (e.g., GDPR, HIPAA, PCI DSS), and budget constraints.
2. **Select a Service Model (IaaS, PaaS, or SaaS)** — Based on the requirements, decide which service model fits. If the team needs full control over the operating system and middleware, choose IaaS. If the team wants to focus solely on code without managing servers, choose PaaS. If the business needs a ready-to-use application like email or CRM, choose SaaS. Many organisations use a mix of all three.
3. **Choose a Deployment Model (Public, Private, Community, or Hybrid)** — Evaluate security, compliance, and cost. Public cloud is the most cost-effective for most workloads. Private cloud is suitable for organisations with strict compliance requirements (e.g., government, finance). Community cloud is for multiple organisations sharing a common mission (e.g., healthcare consortium). Hybrid cloud combines private and public for sensitive data that needs to burst to public cloud during peaks.
4. **Select a Cloud Provider and Region** — Choose a provider (AWS, Microsoft Azure, Google Cloud, or others) based on the services they offer, their global presence, compliance certifications, and pricing. Then select a geographic region where the cloud resources will be hosted, considering latency to end users, data residency laws (data must stay in certain countries), and disaster recovery planning across multiple regions.
5. **Design the Network Architecture** — Plan the virtual network topology: define IP address ranges, create subnets (public and private), set up firewalls (security groups and network ACLs), configure internet gateways, and establish VPN or Direct Connect connections for hybrid scenarios. This step ensures that traffic flows securely between the internet, the cloud resources, and any on-premises systems.
6. **Provision Compute, Storage, and Database Resources** — Launch virtual machines (compute), attach storage volumes (block or object storage), and set up databases (managed or self-managed). Configure auto-scaling to automatically add or remove resources based on demand. Implement load balancers to distribute traffic. This is where the cloud infrastructure physically comes into existence.
7. **Implement Security and Compliance Controls** — Apply identity and access management (IAM) policies to control who can do what. Encrypt data at rest and in transit. Enable logging and monitoring (audit logs, performance metrics). Run vulnerability scans. Ensure the configuration meets the required compliance frameworks (e.g., SOC 2, ISO 27001). This step is critical for passing audits and avoiding breaches.

## Comparisons

### IaaS vs PaaS

**IaaS:**
- Consumer manages the operating system, middleware, and applications
- Provider manages the virtualisation layer, physical hardware, and networking
- Gives maximum control but requires more management effort

**PaaS:**
- Provider manages the operating system, runtime, and middleware
- Consumer only deploys and manages applications and data
- Offers less control but reduces management overhead and accelerates development

### Public Cloud vs Private Cloud

**Public Cloud:**
- Infrastructure is owned and operated by a third-party provider
- Multiple tenants share the same physical infrastructure
- Lower cost due to economies of scale; pay-as-you-go pricing

**Private Cloud:**
- Infrastructure is dedicated to a single organisation
- Provides greater isolation and control over physical security
- Higher cost due to dedicated hardware and operational overhead

### Scalability vs Elasticity

**Scalability:**
- Ability to handle increasing workload by adding resources
- Often planned and can be manual or automatic
- Typically refers to growing capacity (scale up or scale out)

**Elasticity:**
- Ability to automatically scale resources up and down in real-time
- Dynamic and responsive to current demand
- Includes both scaling up and scaling down to match workload

### Multi-tenancy vs Virtualisation

**Multi-tenancy:**
- A model where a single instance serves multiple customers
- Focuses on data isolation and resource sharing among tenants
- Exists at the application or infrastructure level

**Virtualisation:**
- A technology that creates virtual versions of physical resources
- Focuses on abstracting hardware to run multiple operating systems
- Enables multi-tenancy but is not the same concept

### Hybrid Cloud vs Multi-cloud

**Hybrid Cloud:**
- Combination of private cloud and one or more public clouds
- Requires orchestration and standardised technology for portability
- Used for bursting sensitive data to public cloud during peaks

**Multi-cloud:**
- Use of two or more public cloud providers simultaneously
- Does not necessarily include a private cloud component
- Used to avoid vendor lock-in and leverage different provider strengths

## Diagram

_The NIST cloud computing reference architecture showing the five major actors and the service and deployment models._

```mermaid
flowchart TD
    A[Cloud Consumer] --> B[Cloud Broker]
    B --> C[Cloud Provider]
    C --> D[IaaS]
    C --> E[PaaS]
    C --> F[SaaS]
    C --> G[Public Cloud]
    C --> H[Private Cloud]
    C --> I[Community Cloud]
    C --> J[Hybrid Cloud]
    A --> K[Cloud Auditor]
    L[Cloud Carrier] --> C
```

## Common misconceptions

- **Misconception:** The cloud is just someone else's computer, so there is no security difference from on-premises. **Reality:** The cloud introduces a shared responsibility model where the provider secures the physical infrastructure and the consumer secures their data, identities, and configurations. Security responsibilities are divided, not eliminated. (People hear 'someone else's computer' and assume risk transfers entirely. In reality, the consumer retains significant security obligations, especially for data classification, access control, and compliance.)
- **Misconception:** Public cloud is always insecure, and private cloud is always secure. **Reality:** Security depends on configuration, not deployment model. A poorly configured private cloud can be insecure, and a well-configured public cloud with encryption, IAM, and auditing can be very secure. (The word 'private' sounds inherently safer, but private cloud still requires the same security practices. Many breaches in private clouds occur due to misconfiguration or insider threats.)
- **Misconception:** Cloud computing means everything is virtualised, so you can use 100% of the physical hardware. **Reality:** Virtualisation allows over-provisioning, but physical limits still exist. You cannot exceed the actual CPU cores, memory, or disk I/O of the underlying hardware. There is also a 'noisy neighbour' effect where one tenant's heavy usage can affect another tenant's performance. (Beginners see 'infinite scalability' marketing and think physical constraints disappear. The cloud abstracts physical limits but does not eliminate them — it just makes them less visible.)
- **Misconception:** Hybrid cloud means using two different public cloud providers (e.g., AWS and Azure) together. **Reality:** Hybrid cloud specifically means a composition of a private cloud and a public cloud (or community cloud) that remain distinct but are linked by technology enabling data and application portability. Using two public clouds is called multi-cloud, not hybrid cloud. (The term 'hybrid' sounds like it means mixing anything, but the NIST definition is very specific. The CCSP exam tests the exact NIST definitions and will penalise this confusion.)
- **Misconception:** PaaS gives you more control than IaaS because you get a full platform. **Reality:** IaaS gives you more control — you manage the OS, middleware, and applications. PaaS abstracts away the OS and runtime, giving you less control but more convenience. Control decreases as you move from IaaS to PaaS to SaaS. (Non-IT people hear 'platform' and think it is a larger, more capable offering. In reality, PaaS removes management tasks and therefore removes corresponding controls.)
- **Misconception:** Elasticity and scalability are synonyms in cloud computing. **Reality:** Elasticity is the ability to automatically scale resources up and down in response to demand. Scalability is the ability to handle growing amounts of work by adding resources. Elasticity includes both scaling up and scaling down; scalability usually refers to growing, not shrinking. (The words are used interchangeably in casual conversation, but the CCSP exam distinguishes them. Elasticity is specifically about dynamic, automated adjustment, while scalability can be manual or planned.)

## Key takeaways

- The five essential characteristics of cloud computing defined by NIST are on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service.
- The three cloud service models are IaaS (Infrastructure as a Service), PaaS (Platform as a Service), and SaaS (Software as a Service), and control decreases from IaaS to SaaS.
- The four cloud deployment models are public, private, community, and hybrid, and each serves different use cases based on sharing and compliance needs.
- The NIST cloud computing reference architecture identifies the cloud consumer, provider, auditor, broker, and carrier as the five major actors.
- Multi-tenancy enables resource pooling and cost efficiency by allowing a single instance of infrastructure or software to serve multiple customers securely.
- The shared responsibility model dictates that the cloud provider secures the infrastructure and the consumer secures their data, identities, and configurations, with responsibility shifting based on the service model.

## FAQ

**What is the difference between IaaS, PaaS, and SaaS?**

IaaS gives you virtualised hardware (servers, storage, networking) that you manage yourself. PaaS gives you a platform with the operating system and runtime managed by the provider — you just deploy your code. SaaS gives you a fully developed application that you access through a browser, with everything managed by the provider.

**Is public cloud secure?**

Yes, public cloud can be very secure if configured properly. The provider secures the physical data centres and hypervisor layer, but you must secure your own data, user access, and network configurations. The shared responsibility model means security is a joint effort.

**What is multi-tenancy in cloud computing?**

Multi-tenancy is a model where a single instance of software or hardware serves multiple customers (tenants) simultaneously, with each tenant's data isolated from the others. It is the foundation of resource pooling and enables cost efficiency by spreading infrastructure costs across many users.

**What does 'rapid elasticity' mean in the NIST definition?**

Rapid elasticity means cloud resources can be automatically and quickly scaled up or down based on demand. To the user, the resources appear unlimited because they can request more at any time and get it almost instantly.

**What is the difference between public cloud and private cloud?**

Public cloud is owned and operated by a third-party provider and serves multiple organisations over the internet. Private cloud is dedicated to a single organisation, either on-premises or hosted by a provider, and offers more control and isolation at a higher cost.

**What is a cloud broker in the NIST reference architecture?**

A cloud broker is an entity that manages the use, performance, and delivery of cloud services and negotiates relationships between cloud providers and cloud consumers. They may aggregate services from multiple providers, provide custom interfaces, or help with migration.

**Can you use multiple cloud providers at once?**

Yes, that is called a multi-cloud strategy. Organisations use multiple public cloud providers (e.g., AWS and Azure) to avoid vendor lock-in, leverage best-of-breed services from each provider, or meet geographic and compliance requirements.

**What is the shared responsibility model?**

The shared responsibility model defines who is responsible for security in the cloud. The provider is responsible for the security 'of' the cloud (physical hardware, network, hypervisor). The customer is responsible for security 'in' the cloud (data, access management, operating system patches in IaaS). The division changes with the service model.

## Check your understanding

1. **Which of the five essential characteristics of cloud computing ensures that a consumer can provision resources without needing to speak to a human at the provider?**

   Answer: On-demand self-service.

2. **What is the difference between resource pooling in cloud computing and multi-tenancy?**

   Answer: Resource pooling is the characteristic where provider resources are shared across multiple consumers using a multi-tenant model. Multi-tenancy is the architectural approach that enables resource pooling by allowing a single instance to serve multiple tenants securely.

3. **In which service model does the consumer have the least administrative control and responsibility?**

   Answer: Software as a Service (SaaS), because the provider manages the entire application, infrastructure, and platform, and the consumer only uses the software.

4. **A hospital consortium wants to share a cloud environment to comply with healthcare regulations while keeping costs lower than private cloud. Which deployment model is most appropriate?**

   Answer: Community cloud, because it is provisioned for exclusive use by a specific community with shared concerns like compliance and security requirements.

5. **In the NIST cloud computing reference architecture, which actor is responsible for conducting independent assessments of cloud services, performance, and security?**

   Answer: The cloud auditor.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/isc2-ccsp/cloud-computing-concepts-and-architecture