Cloud fundamentals · Worked examples
IaaS vs PaaS vs SaaS: Shared Responsibility Practice
For IaaS, PaaS and SaaS questions, identify the exact task before choosing who owns it. In a typical public-cloud setup, the provider runs the physical infrastructure. You still decide who may access your organisation’s data. The useful dividing question is: are you operating a server, deploying your code to a managed platform, or using a finished application?
This guide is for cloud beginners and AZ-900 learners. Work through the three original scenarios below, then practise with explanations. They are learning exercises, not official Microsoft exam questions.
Start with what the customer operates
| Model | What you use | A task you still own |
|---|---|---|
| IaaS | Virtual machines and infrastructure | Maintain the guest operating system and your software |
| PaaS | A managed platform for your application | Maintain your application code and access settings |
| SaaS | A ready-made hosted application | Decide which users can access your business data |
For Azure examples and a fuller responsibility matrix, see Microsoft’s shared responsibility guidance. The table above is a starting point, not a service contract. “Applications” and “networking” can include tasks on both sides of the boundary.
A three-step way to read the question
- 1. Underline the task.
“Patch the guest OS” is precise. “Manage security” is too broad. Rewrite a vague task as something a person could actually do.
- 2. Identify the service model.
A customer-managed VM suggests IaaS. Deploying code without operating the server suggests PaaS. Using an existing hosted application suggests SaaS.
- 3. State the boundary in one sentence.
Use: “The provider handles ___, while the customer still handles ___.” If you cannot complete both halves, check the service description before choosing an answer.
The UK NCSC guidance explains why responsibility varies with the service and its implementation. An acronym helps narrow the answer; it does not describe every configuration option.
Three scenarios: who does the work?
Write your answer and one reason before opening each explanation. All organisations and situations below are invented.
1. The migrated booking server
A small training company moves its booking application onto a public-cloud VM. Its administrator still logs into the VM to install packages. Who normally patches that VM’s guest operating system: the company or the cloud provider?
Show cloud answer 1
The company. It operates the guest OS in this IaaS example. Running on someone else’s hardware does not mean that software inside the VM is provider-managed. AWS makes this guest-OS distinction explicit in its shared responsibility model; check the chosen service’s terms for any separately managed patching.
2. The custom booking application
Another team deploys its own booking code to a platform that manages the underlying server OS. A developer accidentally removes the application’s permission check. Does the platform’s OS maintenance fix that application bug?
Show cloud answer 2
No. In this PaaS scenario, the team still owns the code it deploys. The provider’s maintenance of the platform is a different task. The useful clue is “its own booking code”, not simply “hosted in the cloud”.
3. The finished booking service
A third company subscribes to a finished booking application. A staff member changes roles and should no longer see customer bookings. Who decides and configures that user’s business access?
Show cloud answer 3
The customer organisation. It must keep its users’ permissions appropriate. The SaaS provider operates the hosted software, but cannot infer every staffing change or internal access decision. “The vendor runs the application” does not mean “the vendor owns all our decisions”.
Fix the reasoning behind a wrong answer
- “It is in the cloud, so the provider does everything.”
Name the remaining customer action in the scenario. In question 3, someone must remove access after the role change.
- “It is PaaS, so every application task is ours.”
Separate your code from the platform running it. Avoid assigning an entire layer to one party when the question names only one task.
- “Public cloud means the data is public.”
Service models and deployment models answer different questions. Public/private/hybrid describes the deployment; IaaS/PaaS/SaaS describes the service offered. NIST distinguishes these in its cloud computing definition.
Make a one-line review note: “I assigned a staffing decision to the provider because I saw SaaS.” Revisit that mistake with a different scenario, rather than memorising an answer letter.
Keep the next session focused
Use the official AZ-900 study guide to check the current scope. It includes shared responsibility and cloud service types; this article covers only that part.
For a broader plan, see our AWS and Azure study guide. If network ranges are your next gap, try our IPv4 subnetting examples.