SaaS, IaaS, and PaaS

teancum144

Although I believe I understand the difference between SaaS, IaaS, and PaaS, I’m struggling with questions worded similarly to the following (answers bolded):

1) Shifting to a greater web presence, a company’s application no longer meets security needs. The data center will continue to provide network and security services. Which will best support this shift?

a. SaaS
b. IaaS
c. Hot Site
d. Mirrored site

2) To reduce the server environment footprint, in-house developed software applications were moved to an alternate environment supported by a third party. This arrangement is best described by?

a. SaaS
b. IaaS
c. PaaS
d. Virtualization

3) Which network solution can best host an extranet application?

a. SaaS
b. IaaS
c. PaaS
d. Virtualization

4) To reduce cost and improve availability, a web based application is being moved out of the country. The CISO requires key authentication systems be run within the company’s network. Which best meets these requirements?

a. SaaS
b. IaaS
c. PaaS
d. Virtualization

Why are numbers 1, 3, and 4 not IaaS (or PaaS)? Is it because the question implies no third-party services are being procured. In other words, is it implied the company itself will be offering the software as a service using its own hardware and software (and located in a different country for #4)?

Why couldn’t #2 be PaaS?

VAnavyGrl

Hi, I just passed the Security+ last night. This is my take on your questions.

#1. The answer is SaaS because they are talking about a web application server that is getting too much traffic, the server cannot handle the amount of folks coming to the web server, so best answer is to have another company host it as a SaaS for so you don't have to worry about hardware limitations.

#2. The answer is IaaS because company is trying to reduce it's sever environment footprint, so the in-house application servers were moved to another location, hosted by a 3rd party. That's how I read what the question was asking. So the application software, application servers were being moved and supported by another company which is IaaS.

#4 This is SaaS, because the web application was moved, however you maintain access to the web application using key authentication and manage the application.

ptilsen

1. You're not moving to an entire hosted platform or infrastructure. You just want that application provided as a service. One application is best served by SaaS. IaaS or PaaS would be an entire infrastructure around one application.
2. You're not moving to an entire hosted platform. You just need server and network infrastructure to host your applications.
3. Same as 1 for the same reasons.
4. Same as 1 and 3, with an added complication that "key authentication systems" must be run within the company's network. This limits the web app to SaaS, since IaaS or PaaS would necessarily included hosted key authentication systems.

lsud00d

The exam is all about keywords. Look for what the focus of the question is because extraneous information will be thrown in to confuse you.

paul78

I gave an overview talk on cloud solutions many years ago and I have to admit that these questions are somewhat vague to me.

#1 – I was trying to pick at the words but I don’t think that I’ve made a connection that would have tied SaaS as the answer other than perhaps a few vague assumptive leaps. I suppose the leap would be that because the company (i) wants a greater web presence and the (ii) existing application is no longer compliance; the company will be replacing their existing application. Since the company will replace their application, the must be seeking a third-party that would provide the software as a service.

#3 – I think that’s just a poorly worded question. If I had an application that I wanted hosted by a third party on the Internet so that it’s accessible by other entities, I would seek a IaaS or PaaS.

#4 – Again – I think it’s poorly worded – what does “application is being moved” mean? A software developer may interpret that to mean “move the application that s/he developed” from datacenter A to datacenter B – so the application needs a IaaS or PaaS. But an end-user could interpret that to mean “move to a new provider” which could be a SaaS.

teancum144

ptilsen wrote: »

1. You're not moving to an entire hosted platform or infrastructure.

But doesn't the SaaS vendor have to provide the infrastructure/platform to host the software?

ptilsen wrote: »

You just want that application provided as a service. One application is best served by SaaS. IaaS or PaaS would be an entire infrastructure around one application.

I see. I'm used to thinking about SaaS as a vendor provided software (e.g. Google Apps) and not as a company's application hosted and supported by a vender. How does that work if the software is in-house developed? Does the vendor need to learn that software so they can support it effectively?

ptilsen wrote: »

2. You're not moving to an entire hosted platform. You just need server and network infrastructure to host your applications.

So is PaaS primarily for developing application and not hosting them?

ptilsen wrote: »

4. Same as 1 and 3, with an added complication that "key authentication systems" must be run within the company's network. This limits the web app to SaaS, since IaaS or PaaS would necessarily included hosted key authentication systems.

How does a vendor host an application (SaaS) without also providing and supporting the underlying infrastructure (and platform if applicable)?

ptilsen

teancum144 wrote: »

But doesn't the SaaS vendor have to provide the infrastructure/platform to host the software?

Yes, but infrastructure and platform are not the service they're selling. The service being provided is hosted software, specifically. Every else is abstracted to the customer, who does not and should not care about it.

teancum144 wrote: »

I see. I'm used to thinking about SaaS as a vendor provided software (e.g. Google Apps) and not as a company's application hosted and supported by a vender. How does that work if the software is in-house developed? Does the vendor need to learn that software so they can support it effectively?

It is certainly easier to provide an organization's own software as a service, but using session virtualization (Terminal Services, XenApp, etc.) or application virtualization (e.g. ThinApp, AppV), a vendor can theoretically provide any full-blown Windows application p. Web applications can obviously be hosted on existing web server resources.

While the vendor does need to have infrastructure to support that, once again, the infrastructure isn't the service the client is paying for.

teancum144 wrote: »

So is PaaS primarily for developing application and not hosting them?

Yes and no. Think of PaaS as an entire solution. If I want a typical Microsoft setup (AD, Exchange, SQL, IIS, Sharepoint, file services, all integrated), Azure could provide a PaaS service for me. AWS could provide a comparable Linux solution stack service for me. Conversely, they could also just provide me with servers and network and let me build the solutions myself.

teancum144 wrote: »

How does a vendor host an application (SaaS) without also providing and supporting the underlying infrastructure (and platform if applicable)?

They don't. Obviously the underlying infrastructure must exist and be supported. But it's not being sold. If I use Office 365, I'm only getting the Office suite provided to me. I don't have access to infrastructure to scope, spec, configure, and deploy virtual machines on my own. Microsoft has done those things and deals with those things so I don't have to, and they are (and again, should) be abstracted from me.

Ecio

Coming from a general understanding of what S/P/I aaS are, having just done VCA-CLOUD but having not studied anything of Security+ (yet, I'm thinking about it) I too think that those questions are far from being very clear...