Objective and the controlling question
By the end of this lesson, you should be able to use an explicit control requirement to distinguish infrastructure, platform and software services, and explain one customer responsibility that remains after a move. Basic familiarity with applications and operating systems is enough. Start with “What must this organization control or consume?” A product name is useful evidence, but a label without the required task is an incomplete decision. These are foundation comparisons, not instructions for deploying or securing a production system.
Three different service boundaries
With infrastructure as a service, such as Azure Virtual Machines, Microsoft manages the underlying cloud infrastructure while the customer manages its virtual machine’s guest operating system and application. Platform as a service, such as Azure App Service, supplies a managed platform on which the customer can deploy an application without administering the underlying VM or operating system. Software as a service, such as Microsoft 365, supplies a ready-made application to use. Customer configuration is possible in SaaS, so “users change settings” does not by itself turn an offering into PaaS. Conversely, being hosted in Azure does not automatically transfer guest-OS management away from an IaaS customer.
Worked example
A fictional neighborhood theatre runs its own booking application. Its small developer team wants to keep editing the application code, but it does not want to administer the operating system or web runtime beneath the application. It has no special host-level requirement. First identify what stays: the theatre brings its own application. That rules out treating a finished SaaS booking product as the same task. Next identify what moves: the platform provider must maintain the underlying OS/runtime. That is the PaaS boundary, illustrated by Azure App Service. A customer-administered VM can host the application but keeps guest-OS work with the theatre, so it does not satisfy both conditions. The conclusion concerns the described responsibility boundary; no claim about the cheapest offering follows.
Change one condition, then trace the remaining decisions
Now suppose a different component must install a host-level operating-system extension and the theatre accepts the associated guest-OS administration. This changed requirement gives a reason to consider an IaaS virtual machine rather than assuming the earlier PaaS choice still applies. In either case, “who should be allowed to see donor records?” remains a customer data/access decision. Microsoft’s maintained infrastructure does not determine the theatre’s legitimate business disclosure rules. Write two separate statements: which lower-layer maintenance moves, and which application/data/identity decision stays. Avoid an all-or-nothing summary such as assigning the entire system to one party; real solutions can combine service models.
Transfer check
Try before reading the check basis: a fictional community newsletter team wants a finished hosted email-and-collaboration application. It has no application code to deploy and no guest OS to manage. Does the fact that an administrator creates user accounts make its offering PaaS? Check basis: no. It consumes a ready-made application, so SaaS fits the stated service relationship; managing its users is a retained customer activity. To check your explanation, name the consumed layer and the retained decision. If your answer depends only on “the administrator did some work,” return to the distinction between configuring an application and deploying one.
Practice, retrieval and limits
Attempt the four linked service-layer questions without reading their explanations first. State the requirement that defeats the strongest alternative, then use the three cards to retrieve one distinction at a time. These are different fictional situations from the teaching example. The independent responsibility guide follows a separate mixed-workflow investigation rather than repeating this lesson. The official source describes governance responsibilities, not a replacement for contractual terms or a complete control-by-control security assessment. This sample does not establish exam readiness, official scores or calibrated difficulty; qualified educator review remains pending.
Try it, then explain it.
Complete a short set without looking at the example. After each answer, explain which evidence or rule supports your decision and why the alternatives do not fit.
Sources & authorship
Original OpenExam explanations and examples. References support the concepts; they are not the source of copied questions. Independent educator review is pending.
Shared responsibility in the cloud