A company rents virtual machines, block storage and virtual networks from a provider. Its own team installs and patches the guest operating systems, deploys its middleware and applications, and configures host firewalls, while the provider runs the physical hosts and the hypervisor. Which NIST SP 800-145 service model is this?

NIST SP 800-145 defines Infrastructure as a Service as the capability to provision processing, storage, networks and other fundamental computing resources on which the consumer can deploy and run arbitrary software, including operating systems and applications. The consumer does not manage the underlying cloud infrastructure but has control over operating systems, storage and deployed applications, and possibly limited control of select networking components such as host firewalls. Every task in the scenario, from patching guest operating systems to configuring host firewalls, sits on the consumer side of that line. Platform as a Service is ruled out because in PaaS the consumer deploys applications onto provider-managed runtimes and does not control the operating system or storage. Software as a Service is ruled out because the consumer uses the provider's application and at most adjusts limited user-specific settings. Community cloud is not a service model at all; it is a deployment model describing infrastructure shared by a specific community, and multi-tenancy on hosts does not make a cloud a community cloud. Exam caveat: service model answers who manages which layer, while deployment model answers who the infrastructure serves. Operational check: confirm in the shared responsibility matrix that OS patching, host firewall rules and data protection are assigned to the company, and track them in its own vulnerability program.