Infrastructure as a Service (IaaS): Control OS, Firewalls, and Networks Without Physical Management
A company wants to migrate its on-premises infrastructure to the cloud while retaining full control over network configuration, firewall rules, and security policies. The company does not want to manage physical servers, storage, or the underlying hypervisor. Which cloud service model BEST meets these requirements?
Quick Answer
This question is testing the same three-model framework as SaaS and PaaS questions, but from the opposite end of the responsibility spectrum. The company explicitly wants to keep control over the things closest to the application, network configuration, firewall rules, and security policies, while handing off everything below that, physical servers, storage, and the hypervisor, to the provider. That division is the defining characteristic of Infrastructure as a Service: the provider supplies virtualized hardware resources, essentially servers, storage, and networking delivered as a service, while the customer is responsible for everything built on top of that virtual hardware, including the operating system, its configuration, and any security policies applied within it. This is different from Platform as a Service, which would additionally take the operating system and runtime environment off the customer's plate, leaving them managing only their application and data, and it's different from Software as a Service, which would remove nearly all technical management responsibility from the customer entirely. Whenever a scenario specifically calls out that a company wants to retain control over the operating system, network, or security configuration while avoiding responsibility for physical hardware, that combination of retained low-level control paired with offloaded physical infrastructure is the signal to choose Infrastructure as a Service.
⚠ Common exam trap
Watch out — candidates often confuse PaaS with IaaS, thinking PaaS offers full network control, but PaaS abstracts the infrastructure layer, restricting direct management of firewalls and network policies, whereas IaaS explicitly provides that control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IaaS (Infrastructure as a Service)
IaaS (Infrastructure as a Service) provides virtualized computing resources over the internet, allowing the company to manage network configurations, firewall rules, and security policies while the cloud provider handles physical servers, storage, and the hypervisor. This model gives the customer control over the operating system, middleware, and applications, but not the underlying physical infrastructure, directly matching the requirement to avoid managing physical hardware.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SaaS (Software as a Service)
Why it's wrong here
SaaS delivers finished applications, leaving no access to network configuration, firewall rules or security policies, so it cannot satisfy the stated control requirement. It is tempting because SaaS eliminates all infrastructure management, and it would be correct if the company simply needed a hosted application such as email.
When this WOULD be correct
A company needs a fully managed email or collaboration suite (e.g., Office 365, Google Workspace) and does not want to manage any underlying infrastructure, software, or customization beyond user settings.
- ✗
PaaS (Platform as a Service)
Why it's wrong here
PaaS abstracts the platform layer, so you deploy code without controlling the network stack, firewall rules or security policies the company must retain. It is tempting because PaaS suits developers needing managed runtimes and databases, but here the requirement is infrastructure-level control, which only IaaS provides.
When this WOULD be correct
A company wants to develop and deploy custom applications without managing the underlying OS, runtime, or middleware, but still needs control over the application and data. PaaS would be correct if they only need to manage code and data, not network or security policies.
- ✓
IaaS (Infrastructure as a Service)
Why this is correct
IaaS delivers virtualised compute, storage and networking while the customer retains control of firewall rules, network topology and security policies. The provider manages the physical hardware and hypervisor, satisfying the requirement to avoid managing servers, storage or the underlying hypervisor.
- ✗
DaaS (Desktop as a Service)
Why it's wrong here
DaaS delivers virtual desktops to end users, not the network, firewall and security policy control over cloud infrastructure the company requires. It is tempting because DaaS removes physical server management, but it is the right choice only when the goal is provisioning remote user desktops.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 220-1101 exam frequently reuses these exact scenarios with slightly different constraints.
✓IaaS (Infrastructure as a Service)Correct answer▾
Why this is correct
IaaS delivers virtualised compute, storage and networking while the customer retains control of firewall rules, network topology and security policies. The provider manages the physical hardware and hypervisor, satisfying the requirement to avoid managing servers, storage or the underlying hypervisor.
✗SaaS (Software as a Service)Wrong answer — click to see why▾
Why this is wrong here
SaaS provides ready-to-use applications managed entirely by the provider, giving the customer no control over network configuration, firewall rules, or security policies beyond basic settings.
★ When this WOULD be the correct answer
A company needs a fully managed email or collaboration suite (e.g., Office 365, Google Workspace) and does not want to manage any underlying infrastructure, software, or customization beyond user settings.
Why candidates choose this
Candidates may confuse 'cloud migration' with simply moving to any cloud service, overlooking the requirement for control over network and security configurations.
✗PaaS (Platform as a Service)Wrong answer — click to see why▾
Why this is wrong here
PaaS provides a platform for application development and deployment but abstracts away control over network configuration, firewall rules, and security policies, which the company requires.
★ When this WOULD be the correct answer
A company wants to develop and deploy custom applications without managing the underlying OS, runtime, or middleware, but still needs control over the application and data. PaaS would be correct if they only need to manage code and data, not network or security policies.
Why candidates choose this
Candidates may confuse PaaS with IaaS, thinking PaaS offers more control than it actually does, or they may not fully understand that PaaS abstracts infrastructure management, including network and security controls.
Analysis generated from the official 220-1101blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Proxy Server Configuration
Key term
Anything As A Service
A model where you rent any IT resource or service over the internet instead of owning it.
Key term
Operating system
An operating system (OS) is the core software that manages a computer's hardware and software resources, providing common services for computer programs.
About these practice questions
One of 896 original 220-1101 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on 220-1101
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to migrate its on-premises infrastructure to the cloud. The security team requires that the company retains full control over network configuration, firewall rules, and security policies, but they do not want to manage physical servers, storage, or the underlying hypervisor. Which cloud service model BEST meets these requirements?
medium- A.Software as a Service (SaaS)
- B.Platform as a Service (PaaS)
- ✓ C.Infrastructure as a Service (IaaS)
- D.Database as a Service (DBaaS)
Why C: Infrastructure as a Service (IaaS) provides virtualized computing resources over the internet, allowing the company to manage and control the network configuration, firewall rules, and security policies while the cloud provider handles the physical servers, storage, and hypervisor. This model gives the customer full control over the operating system, storage, and deployed applications, meeting the requirement of not managing the underlying physical infrastructure.
Variation 2. A company is migrating its on-premises infrastructure to a cloud provider. The IT team needs full control over the operating system, the ability to install custom applications, and the ability to configure network settings such as firewalls and subnets. They want to avoid managing the physical hardware. Which cloud service model BEST meets these requirements?
medium- A.Software as a Service (SaaS)
- B.Platform as a Service (PaaS)
- ✓ C.Infrastructure as a Service (IaaS)
- D.Desktop as a Service (DaaS)
Why C: Infrastructure as a Service (IaaS) provides virtualized computing resources over the internet, giving the IT team full control over the operating system, the ability to install custom applications, and the ability to configure network settings such as firewalls and subnets, while the cloud provider manages the physical hardware. This model abstracts the underlying hardware but exposes the virtual infrastructure, meeting all stated requirements.
Variation 3. A company uses a cloud service that provides virtual machines. The company administrators have full control over the guest operating systems, install their own applications, and manage security patches and updates. The cloud provider is responsible for the underlying physical servers, storage, and networking. This scenario best describes which cloud service model?
medium- ✓ A.Infrastructure as a Service (IaaS)
- B.Platform as a Service (PaaS)
- C.Software as a Service (SaaS)
- D.Desktop as a Service (DaaS)
Why A: This scenario describes Infrastructure as a Service (IaaS) because the company has full control over the guest operating systems, applications, and security patches, while the cloud provider manages the underlying physical infrastructure (servers, storage, networking). In IaaS, the provider delivers virtualized computing resources over the internet, and the customer retains administrative access to the OS and installed software, which matches the description exactly.
Variation 4. A company is migrating its on-premises web servers to the cloud. They want to maintain full control over the operating system, web server software, and security configurations, but they do not want to manage the underlying physical hardware, storage, or network infrastructure. Which cloud service model best meets these requirements?
medium- A.Software as a Service (SaaS)
- B.Platform as a Service (PaaS)
- ✓ C.Infrastructure as a Service (IaaS)
- D.Desktop as a Service (DaaS)
Why C: Infrastructure as a Service (IaaS) provides virtualized computing resources over the internet, allowing the company to deploy and manage their own operating systems, web server software, and security configurations while the cloud provider handles the underlying physical hardware, storage, and network infrastructure. This matches the requirement for full control over the OS and software stack without managing physical components.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1101 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1101 exam.