ISC2 CC Network and Cloud Security: Models and Trust Decisions

What changes between SaaS, PaaS and IaaS?

For ISC2 CC network and cloud scenarios, identify what the customer controls, who the cloud serves, and what authorizes access. ISC2's outline assigns 21.3% to Networking and Cloud Security Concepts and explicitly includes cloud service models, deployment models and shared security responsibilities. The outline is effective September 1, 2026, checked November 3, 2026.

NIST's cloud definition distinguishes three service models by what customers can use or manage. Start with the action in the scenario:

The examples here are original teaching cases, not recalled ISC2 questions. In each, the important clue is the customer's level of control. The fact that all three services are reached over a network does not distinguish them.

Try covering the first column and naming the model from the action. If you can name it but cannot explain why another model does not fit, repeat the comparison before adding more terminology. For broader practice, full ISC2 CC prep planned for launch includes 900 questions across the five domains.

How do deployment models differ from service models?

Service models describe the capability offered and the customer's control. Deployment models describe whom the cloud infrastructure serves and how distinct clouds are combined. These answer different questions, so do not substitute one label for the other.

NIST identifies four deployment models:

For example, a company uses a cloud exclusively for its own organization at an off-site facility. The exclusivity points to private cloud; the off-site location does not rule it out. You still need another fact to identify SaaS, PaaS or IaaS: what does the company control within that cloud?

Now change the scenario: several organizations with shared concerns use a cloud together. That points to community cloud. The shared concerns, rather than simply the existence of several users, make the distinction.

Keep these classifications alongside the full ISC2 CC domain map. This guide practices selected cloud and architecture concepts; Domain 4 also includes network foundations that require separate study.

Which security responsibilities remain with the customer?

Use the stated service arrangement to identify the customer's control. NIST's definitions support the broad distinction between configuring a provider's application, controlling your own deployed application, and controlling an operating system. They do not provide a universal security task list for every vendor's service.

Consider three original responsibility exercises:

1. SaaS: A hosted application lets the customer's administrator choose which employees can use a workspace. The question asks who must review those customer-controlled settings. Point to the customer administrator named in the scenario; do not assume that using SaaS removes that task.
2. PaaS: A development team deploys and controls its application, while the provider manages the underlying operating system. If the question concerns changing that application's behavior, focus on the team's application control. Do not assign the team control over the operating system when the scenario explicitly places it with the provider.
3. IaaS: The customer manages a virtual operating system and installs software. An operating-system change falls within the customer control described here. The provider's management of underlying infrastructure does not mean it manages that customer-controlled system too.

These conclusions depend on the facts given in each exercise. For a real service, check its documented responsibility division before assigning a task. For a study question, underline the sentence that gives the relevant party control; if there is no such detail, avoid inventing one.

When the task is deciding who should have permission, continue with the ISC2 CC identity and access-control scenarios. For definition recall between practice sessions, full ISC2 CC prep planned for launch includes 450 flashcards.

How do segmentation and zero trust solve different problems?

ISC2 includes segmentation and zero trust under network security architecture. Segmentation is an architecture control; it is not the whole zero-trust approach. NIST's zero-trust definition rejects implicit trust based solely on network location or asset ownership and treats authentication and authorization as separate functions before a resource session.

Use this original case: an employee's company-owned device is connected to an internal network segment. The employee requests access to a resource. A proposed rule allows access automatically because the device is internal and belongs to the organization.

That rule conflicts with the zero-trust principle described by NIST. Neither the internal location nor company ownership supplies sufficient grounds for implicit trust. The access decision still needs authentication and authorization for the requested resource.

Adding segmentation does not, by itself, answer that access question. Separate these two observations when reviewing an option:

• Architecture observation: the organization has separated its network into segments.
• Access observation: the requested resource session still requires an authentication and authorization decision.

Do not infer the second from the first. If you are also unsure what the organization is trying to protect, use the ISC2 CC security-principles scenarios to distinguish the security objective before selecting a control.

How should you reason through a mixed cloud-and-network scenario?

Use one question at a time. Here is an original combined case:

A company deploys its own application on a provider-managed platform. The provider manages the underlying operating system. The application runs in a cloud used exclusively by that company, and employees request access from company-owned devices on an internal network.

Work through the facts in order:

1. What does the customer control? Its deployed application, with the underlying operating system managed by the provider: PaaS.
2. Who uses the cloud? One organization exclusively: private cloud.
3. Which responsibility is actually described? The company controls its application; the provider manages the underlying operating system. Assign an action to the relevant level, without inventing additional contract terms.
4. Does location or ownership authorize access? No implicit trust follows from either fact under zero trust. Authentication and authorization remain separate decisions before a resource session.

Change one fact and explain which answer changes. If the company now manages the virtual operating system, revisit the service model. If the cloud now serves several organizations with shared concerns, revisit the deployment model. Neither change makes internal location an automatic authorization rule.

Next, try the 20 free ISC2 CC practice questions and record which distinction caused each mistake. Put a focused review session into the free ISC2 CC study plan. Before paying for an appointment, use the ISC2 CC exam cost guide to plan the separate exam costs.

When you want to move from individual concepts to a broader rehearsal, full ISC2 CC prep planned for launch includes a 125-question mock exam. Keep the immediate goal concrete: explain the evidence for each model and each access decision without relying on a familiar-looking label.