2.1 Cloud Computing Concepts (Domain 1.1)
Key Takeaways
- Cloud computing is on-demand network access to a shared pool of configurable resources that can be rapidly provisioned and released with minimal management effort.
- Know the five primary cloud roles: customer, Cloud Service Provider (CSP), cloud service partner, cloud service broker, and regulator — each owns different responsibilities.
- Essential characteristics from NIST/ISO-style models include on-demand self-service, broad network access, multi-tenancy, rapid elasticity/scalability, resource pooling, and measured service.
- Building-block technologies are virtualization, storage, networking, databases, and orchestration — they underpin every service category and deployment model.
- On CCSP scenarios, map who controls the control plane and who consumes the service before you assign security ownership.
Cloud Computing Concepts
Domain 1 opens with vocabulary every CCSP candidate must own cold. The exam does not merely ask you to recite a definition — it embeds definitions inside architecture, risk, and shared-responsibility scenarios. If you cannot tell a cloud service from a managed hosting contract, or a broker from a partner, you will mis-assign controls later when the question turns operational.
Cloud Computing Definitions
Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service-provider interaction. That formulation — drawn from the NIST SP 800-145 lineage and aligned with ISO/IEC 17788-style terminology — is the exam’s working definition.
Break the definition into testable pieces:
| Phrase | What it rules out |
|---|---|
| On-demand network access | Resources locked behind a change ticket for every request |
| Shared pool | Dedicated single-tenant gear with no abstraction |
| Configurable resources | Fixed appliances you cannot reshape programmatically |
| Rapidly provisioned/released | Multi-week hardware lead times as the default path |
| Minimal management effort | Heavy human orchestration for routine capacity changes |
Cloud services are the concrete offerings delivered under that model (compute instances, object stores, identity platforms, SaaS applications). A cloud environment is the operational context in which those services run — public regions, private clouds, or hybrid combinations. Cloud computing is the model; a virtual private server rented for three years with no API may be outsourced infrastructure, but it fails several essential characteristics and is a common distractor.
Related terms you will see on the exam:
- Multi-tenancy — multiple customers share underlying physical or logical resources while remaining logically isolated.
- Abstraction — infrastructure details are hidden behind service interfaces (APIs, consoles, CLIs).
- Utility computing — pay for consumption like a metered utility rather than capital purchase of capacity.
- Service orchestration — automated arrangement, coordination, and management of complex systems and services.
Cloud Computing Roles and Responsibilities
ISO/IEC and CSA materials consistently distinguish several parties. CCSP expects you to know who does what when a control fails.
| Role | Definition | Typical responsibilities |
|---|---|---|
| Cloud service customer | Organization or individual that uses cloud services | Classify data, configure tenant controls, manage identities, meet regulatory duties for their data, monitor usage against SLAs |
| Cloud Service Provider (CSP) | Entity that makes cloud services available | Secure and operate the shared platform (as scoped by the service category), maintain physical facilities, patch host/hypervisor layers they own, publish SLAs and assurance reports |
| Cloud service partner | Party that supports or complements the CSP (ISV, integrator, managed service firm) | Build solutions on the platform, co-market services, implement customer workloads under contract |
| Cloud service broker | Intermediary that negotiates relationships between customers and CSPs | Aggregation, arbitrage, or intermediation of services; may present a single interface across multiple CSPs |
| Regulator | Authority that sets and enforces rules | Issue privacy, sector, or security requirements; audit or sanction non-compliance |
Exam trap: A managed service partner who configures your identity federation is still a partner or customer agent — they do not become the CSP. The CSP remains the provider of the underlying cloud service. A broker that only resells capacity without operating the infrastructure is not the CSP either; liability and audit rights still need contract language that reaches the actual provider.
Worked scenario: A hospital contracts Broker B to place electronic health record workloads on CSP C, with Partner P implementing encryption and logging. Customer remains accountable for protected health information. CSP C secures the infrastructure layers in scope for the chosen service category. Partner P implements controls under the hospital’s direction. Broker B may help select regions and negotiate rates. Regulators (health privacy authorities) still expect the hospital to demonstrate appropriate safeguards — outsourcing never erases accountability.
Essential Cloud Computing Characteristics
Memorize these characteristics; exam items often ask which trait is missing when something is “not really cloud.”
| Characteristic | Meaning | Security implication |
|---|---|---|
| On-demand self-service | Consumer provisions compute, storage, network, and more unilaterally via portal/API without human gatekeepers for routine requests | Misconfiguration risk rises — least privilege and guardrails matter |
| Broad network access | Capabilities available over the network through standard mechanisms (browsers, mobile, APIs) | Expand attack surface; need strong identity, TLS, and endpoint hygiene |
| Multi-tenancy | Multiple customers share infrastructure with logical isolation | Isolation failure (noisy neighbor, side channels, control-plane bugs) becomes a design threat |
| Rapid elasticity and scalability | Capacity scales out/in quickly, often automatically, matching demand | Auto-scaling can amplify cost and blast radius if not bounded |
| Resource pooling | Provider resources are pooled to serve multiple consumers using a multi-tenant model; location of exact hardware may be abstracted | Data residency and sovereignty require contractual/region controls |
| Measured service | Usage is metered, monitored, controlled, and reported | Metering data supports chargeback, anomaly detection, and forensics |
NIST’s classic five are on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. Multi-tenancy is called out explicitly on the CCSP outline because isolation and shared-infrastructure risk are central to cloud security. Treat multi-tenancy as an essential characteristic you must defend in design reviews.
Quick discrimination drill: A co-location cage with power and cooling is not cloud by itself. A virtualization cluster that still requires a two-week ticket for every new VLAN and has no metering fails on-demand self-service and measured service. A true cloud service exposes self-service APIs, meters consumption, and scales elastically within policy.
Building Block Technologies
Cloud platforms are compositions of foundational technologies. CCSP expects you to recognize each block and the security questions it raises.
Virtualization
Virtualization abstracts physical CPUs, memory, and devices into virtual machines (VMs) or containers managed by a hypervisor (Type 1 bare-metal or Type 2 hosted) or a container runtime. Benefits include density, snapshotting, rapid cloning, and mobility. Risks include hypervisor escape, VM sprawl, insecure images, and weak isolation between tenants. The control plane that schedules VMs is a high-value target — compromise there is more severe than compromise of a single guest.
Storage
Cloud storage appears as block (volumes attached to compute), file (shared file systems), and object (API-addressable objects with metadata). Durability and availability designs (replication, erasure coding, multi-AZ) are provider-side; encryption, access policies, lifecycle rules, and classification remain customer duties in most models. Ephemeral local disks differ from persistent volumes — data can vanish when an instance stops unless you designed for persistence.
Networking
Software-defined networking (SDN), virtual private clouds/networks, subnets, route tables, gateways, load balancers, and private link-style service endpoints form the connectivity fabric. Security groups / network security groups, network ACLs, and microsegmentation implement isolation. Because everything is reachable via API, identity often becomes the new perimeter — but network controls remain mandatory for defense in depth.
Databases
Managed relational, document, key-value, graph, and data-warehouse services remove undifferentiated heavy lifting (patching engines, storage management) while shifting responsibility boundaries. Customers still own schema design, access control, encryption keys (when customer-managed), and query/injection risks at the application layer.
Orchestration
Orchestration automates provisioning, configuration, scaling, healing, and teardown across compute, network, and storage — think infrastructure as code, container orchestrators, and workflow engines. Orchestration multiplies speed and consistency but also multiplies blast radius: a single pipeline credential or mis-templated policy can create thousands of noncompliant resources. Secure orchestration means least-privilege automation identities, signed templates, policy-as-code gates, and immutable audit of every apply.
Putting It Together for the Exam
When a CCSP item describes a workload, ask four questions in order: (1) What service category and deployment model are in play? (2) Which roles are named? (3) Which essential characteristics drive the risk (elasticity, multi-tenancy, broad access)? (4) Which building blocks host the sensitive asset? Those four answers usually point to the correct control owner and the right mitigation. Domain 1.1 is vocabulary and mental models; Domains 2–5 will reuse every term above without redefining it.
Common Traps
- Equating “someone else runs servers” with cloud when self-service, elasticity, and measured service are absent.
- Treating the cloud broker as the CSP for shared-responsibility purposes.
- Forgetting multi-tenancy when evaluating isolation and residual risk.
- Assuming orchestration is only a DevOps convenience rather than a security-critical control plane.
Which statement best matches the NIST-aligned definition of cloud computing used on the CCSP exam?
A hospital hires Firm B to select and negotiate multi-cloud services, then places workloads on Provider C. Firm B does not operate the infrastructure. Which role does Firm B primarily fill?
Which essential characteristic most directly explains why a compromised automation pipeline can create thousands of noncompliant resources within minutes?
Which set correctly lists the building-block technologies emphasized for cloud computing on the CCSP outline?