Most CPA candidates believe memorizing the definitions of IaaS, PaaS, and SaaS is enough to pass the cloud computing questions on the ISC exam. This is a trap. The exam doesn't test your ability to recite a definition; it tests your judgment on who is responsible for what when something inevitably goes wrong.
Cloud computing models on the CPA ISC exam test your ability to apply the shared responsibility model to differentiate between Infrastructure (IaaS), Platform (PaaS), and Software (SaaS). You must determine which party—the client or the vendor—is accountable for specific controls, from application security to data management, in a given business scenario.
Key facts
- Exam Section: Information Systems and Controls (ISC)
- Official Body: American Institute of Certified Public Accountants (AICPA)
- Core Models: Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS)
- Key Framework: AICPA Trust Services Criteria (for SOC 2/3 reports); SOC 1 reports use control objectives relevant to user entities' financial reporting.
- Exam Format: Multiple-Choice Questions (MCQs) and Task-Based Simulations (TBS)
- ISC Blueprint Area (2026): Information Systems and Data Management (15-25% of section)
The AICPA reports the cumulative pass rate for the CPA Exam typically hovers between 49-55% across all sections (AICPA), which highlights the need for deep, judgment-based preparation.
What are Cloud Computing Models and Why Do They Matter for the CPA Exam?
Cloud computing models are frameworks that determine the level of service and management a cloud provider offers a client. For the ISC exam, this is a direct test of your understanding of risk and internal controls in a modern business environment. When a company moves functions to the cloud, it outsources the task, but it can never fully outsource the risk.You will be expected to act as a CPA advising a client. This means evaluating which model—IaaS, PaaS, or SaaS—best fits a specific business scenario. The questions will not be as simple as "Which service provides a virtual machine?" Instead, they will be framed around business risk: "A company needs to rapidly deploy a custom application with minimal infrastructure management. Which model best suits this need, and what specific data security controls must the company itself implement?"
Studying for CPA ISC? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
The AICPA tests this under the "Information Systems and Data Management" domain, which makes up a significant 15-25% of your ISC score, one of the three CPA Discipline sections. You can learn more about the new CPA exam structure here. Seeing how these concepts are tested is the fastest way to learn. You can try VoraPrep's adaptive CPA practice questions for free.
The biggest mistake candidates make is treating these models as a simple vocabulary list. They memorize that IaaS is like renting hardware, PaaS is a workshop, and SaaS is a finished product. This is true, but incomplete. The examiner knows this and will design questions that punish rote memorization and reward an understanding of control implications.
Your job is to know exactly where the cloud provider's responsibility ends and your client's begins.
The Core Service Models: IaaS, PaaS, and SaaS
The three core cloud service models—Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS)—are differentiated by the specific technology layers managed by the cloud provider versus the customer. To score well, you must move beyond definitions and into the practical application of the shared responsibility model. This model dictates who is responsible for what, from the physical data center security up to the user data itself.The following table breaks down this division of labor. Pay close attention to the shared responsibilities for access and data.
| Responsibility Layer | Infrastructure as a Service (IaaS) | Platform as a Service (PaaS) | Software as a Service (SaaS) |
|---|---|---|---|
| Data Content & Classification | Customer | Customer | Customer |
| User Access Management | Customer | Customer | Customer |
| Application | Customer | Customer | CSP |
| Operating System | Customer | CSP | CSP |
| Virtualization | CSP | CSP | CSP |
| Servers & Storage | CSP | CSP | CSP |
| Networking | CSP | CSP | CSP |
| Physical Data Center | CSP | CSP | CSP |
Infrastructure as a Service (IaaS)
The Cloud Service Provider (CSP) provides fundamental computing resources—servers, storage, and networking. The customer is responsible for everything on top, including the operating system (e.g., Windows, Linux), middleware, and all applications and data. Think of it as leasing an empty warehouse; you decide how to set up the shelves, what to put on them, and who has the key. This offers the most flexibility and control but also the greatest security burden for the client.Platform as a Service (PaaS)
The CSP manages the hardware and the operating system. The customer only manages their own applications and data. This is like leasing a fully equipped workshop; the power tools and workbench are provided, but you bring your own materials and build your own product. This is ideal for development teams who want to build and run applications without managing the underlying infrastructure.Software as a Service (SaaS)
The CSP manages everything—the hardware, OS, and the application software itself. The customer simply uses the software, but remains responsible for managing their own data (its content and classification) and user access (assigning roles and permissions within the application). Think of this as a subscription to a magazine; you read the content but have no control over the printing press. Examples include Salesforce, Office 365, and VoraPrep's own adaptive learning platform.Advanced Deployment Concepts
Advanced deployment concepts like hybrid cloud, multi-cloud, and containerization represent different architectural strategies for implementing the core IaaS, PaaS, and SaaS models.- Hybrid Cloud: This is a mix of on-premises private cloud and a third-party public cloud, with orchestration between the two. A company might use a private cloud for sensitive financial data (to maintain control) but use a public cloud for development and testing (to save costs).
- Multi-Cloud: This means using services from more than one public cloud provider (e.g., using Amazon Web Services for storage and Google Cloud for analytics). The key challenge here is managing security and ensuring interoperability between different vendors.
- Containerization (e.g., Docker): This is a lightweight alternative to full virtual machines. A container packages an application and all its dependencies into a single, isolated "box" that can run consistently on any infrastructure. For the exam, know that this enhances portability and efficiency, often used within IaaS or PaaS models.
How Examiners Test Judgment
The examiner wants to see if you can connect these models to business objectives and risks. You won't just be asked to define PaaS. You'll be given a scenario and asked to recommend a model. Understanding this is what separates a passing candidate from a failing one, and it's a core difference in how various CPA review courses approach teaching—some focus on lectures, while we focus on judgment.The key judgment factors are:
- Control vs. Convenience: Does the company need deep control over the operating system (favoring IaaS), or do they want to offload management (favoring PaaS or SaaS)?
- Expertise: Does the company have a large, skilled IT team capable of managing servers and databases (IaaS), or are they lean and need a managed solution (SaaS)?
- Compliance: Are there specific regulatory requirements (like HIPAA or GDPR) that dictate where data must be stored and how it must be secured? For CPAs, this often relates to SOC reports and the Trust Services Criteria.
The real test is applying these factors to a messy, real-world scenario.
Worked Example: Choosing the Right Cloud Model
Let's walk through a typical ISC-style problem. This is where you move from memorizing to applying judgment.
> 💡 Worked example: > FinServ Corp, a mid-sized financial planning firm, wants to deploy a new, proprietary portfolio analysis application for its advisors. The application was developed in-house. The firm's IT department consists of three people who are experts in network management but have limited experience managing and patching database servers. The firm is subject to regulations requiring tight control over client data access and encryption keys. They want to minimize the time spent on infrastructure maintenance to focus on improving the application itself. > > Which cloud computing model is most appropriate for FinServ Corp, and why? > . > A. SaaS, because it requires the least management overhead. > B. IaaS, because it provides the most control over the environment for security. > C. On-premises private cloud, because it offers maximum security for sensitive data. > D. PaaS, because it allows them to deploy their custom application while offloading server and database management.
Step 1: Deconstruct the Business Needs
First, identify the key constraints and goals from the prompt.- Application: Proprietary, developed in-house. This means they need to deploy and manage their own application.
- IT Team: Small, with limited database/server management skills. This is a major constraint.
- Regulatory Needs: Require tight control over data access and encryption.
- Primary Goal: Minimize infrastructure maintenance and focus on the application.
Step 2: Evaluate the Options Against the Needs
Now, let's analyze each choice through the lens of FinServ's situation.- Choice A (SaaS): This model is for consuming a finished application provided by a vendor. FinServ needs to deploy its own custom application. SaaS is immediately incorrect. This is a common distractor for those who only focus on "least management."
- Choice B (IaaS): This provides servers, but FinServ would be responsible for installing, managing, and patching the operating system, the database software, and all other middleware. Their small IT team with limited server experience makes this a high-risk, high-overhead option. While it offers control, it directly contradicts their goal of minimizing infrastructure maintenance.
- Choice C (On-premises): This provides maximum control but also maximum cost and management burden. It would require them to buy, install, and maintain all hardware and software, which is the opposite of their stated goal.
- Choice D (PaaS): This model provides the "platform"—the servers, operating system, and database management system. The cloud provider handles all the patching and maintenance of that underlying stack. FinServ's team can simply deploy their custom application on top of this managed platform. This meets all their needs: they can run their own app, they have control over the application-level security and data, and they offload the server maintenance they are ill-equipped to handle.
Step 3: Identify the Tempting Wrong Answer
The most tempting wrong answer is B (IaaS). Candidates often get fixated on the word "control." They see "tight control over client data" and immediately jump to IaaS because it offers the most control over the server environment.This is a failure of judgment. The prompt requires control over data access and encryption, which can be implemented at the application level within a PaaS model. Choosing IaaS would solve one problem (control) by creating a much larger one (unmanageable operational burden), making it the wrong business decision. The CPA exam tests your ability to make the right business decision, balancing all factors.
Check Your State’s Exact CPA Exam Requirements
Every state has different credit hour, ethics, and residency rules. Use our 55-jurisdiction checker to verify your eligibility before applying.
The correct answer is D.
Practice Questions: Test Yourself
Answering scenario-based questions is the only way to train your judgment. The VoraPrep adaptive engine has over 9,500 questions, including dozens specifically on cloud computing and IT controls, that will target your weak areas.Here are a few examples modeled after the real exam.
Sample Question 1 Apex Solutions is migrating its data center to the cloud using an Infrastructure as a Service (IaaS) model. According to the shared responsibility model, which of the following is Apex Solutions responsible for securing?> Explanation: The correct answer is D. In an IaaS model, the cloud provider is responsible for the physical data center, the core network, and the virtualization layer (A, B, C). The customer is responsible for everything above that, which includes securing the operating system (e.g., applying security patches), managing databases, and securing the applications they install.
Sample Question 2 GlobalTech Enterprises utilizes a cloud service provider for its critical business applications. Due to increasing cyber threats, the company's auditor is concerned about the provider's internal controls. Which of the following reports would provide the most assurance regarding the design and operating effectiveness of the cloud provider's security and availability controls?> Explanation: The correct answer is D. A SOC 2 report is specifically focused on controls at a service organization relevant to the Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. A Type 2 report provides assurance on both the design and the operating effectiveness of those controls over a period of time. This is more comprehensive than a Type 1 report, which only covers a point in time.
Sample Question 3 MedData Inc., a healthcare provider, is migrating its patient records to a cloud service. They must comply with regulations requiring that patient data remains encrypted both in transit and at rest. When evaluating a Software as a Service (SaaS) provider for electronic health records, whose responsibility is it to ensure the application encrypts data at rest on the provider's servers?> Explanation: The correct answer is D. In a SaaS model, the provider is responsible for managing the application and the underlying infrastructure. This includes application-level controls like encrypting data stored within the application's database ("at rest"). MedData is ultimately responsible for ensuring compliance, which includes performing due diligence and contractually obligating the provider to meet these requirements, often verified by a SOC 2 report. However, the implementation responsibility lies with the SaaS vendor.
You can build unlimited quizzes on cloud computing models and data management to master these distinctions.