CCP (Other exams) cheat sheet

NIST SP 800-145 defines five essential characteristics of cloud computing: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service.

The three standard service models are IaaS (provider manages virtualization through physical infrastructure; consumer manages OS and above), PaaS (provider manages runtime and middleware; consumer manages applications), and SaaS (provider manages the full stack; consumer uses the application).

The four standard deployment models are public, private, hybrid, and community cloud; hybrid combines two or more distinct models bound by proprietary technology enabling data and application portability.

Fault tolerance is the ability of a system to continue operating in the event of a component failure, typically achieved through redundancy; high availability targets a percentage uptime, where 99.9% allows about 8.77 hours of downtime per year and 99.99% allows about 52.6 minutes.

Scalability is the ability to increase capacity (vertical: add resources to a single node; horizontal: add nodes); elasticity is the automatic, rapid scaling in and out to match demand.

A multi-tier architecture separates presentation, application, and data layers; stateless tiers can scale horizontally, while stateful tiers require session affinity or shared state stores.

Loose coupling via message queues and asynchronous events reduces the blast radius of failures and allows independent scaling of producers and consumers.

Total cost of ownership comparisons between on-premises and cloud should include not only compute and storage but also power, cooling, real estate, licensing, and administrative labor.

The shared responsibility model divides security duties: the provider is responsible for security of the cloud (physical, hypervisor, managed service infrastructure), while the customer is responsible for security in the cloud (identity, data, configuration, and, for IaaS, the guest OS).

Least privilege: grant only the permissions required to perform a task, and use roles or temporary credentials instead of long-lived access keys.

Encryption should be applied at rest (disk or object encryption) and in transit (TLS 1.2 or higher); key management services separate key custody from data access.

Identity federation via SAML 2.0 or OIDC allows users to authenticate with a corporate identity provider and receive temporary cloud credentials, avoiding separate cloud passwords.

Compliance frameworks include SOC 2 (trust services criteria), ISO/IEC 27001 (information security management), PCI DSS (payment card data), HIPAA (protected health information), and GDPR (EU personal data).

A data classification scheme (e.g., public, internal, confidential, restricted) determines the controls, retention, and encryption required for each data type.

Logging and monitoring requirements typically include enabling audit trails (e.g., control-plane API logs), centralizing logs in an immutable store, and alerting on anomalous access patterns.

Vulnerability management includes regular scanning, patch SLAs based on severity, and penetration testing under the provider's rules of engagement.

Infrastructure as Code (IaC) treats infrastructure definitions as versioned source files; declarative tools (e.g., Terraform) converge to a desired state, while imperative scripts execute steps in order.

Immutable infrastructure replaces servers rather than modifying them in place, which reduces configuration drift and simplifies rollback.

CI/CD pipelines automate build, test, and deployment; blue/green and canary strategies reduce release risk by shifting traffic gradually.

The four golden signals for monitoring are latency, traffic, errors, and saturation; SLOs define target reliability, and error budgets are the allowable unreliability (1 minus SLO).

Mean time to recovery (MTTR) measures how quickly service is restored; mean time between failures (MTBF) measures reliability; availability = MTBF / (MTBF + MTTR).

Backup strategy uses the 3-2-1 rule: three copies of data, on two different media, with one copy off-site; restore testing validates recovery point objective (RPO) and recovery time objective (RTO).

Change management in cloud environments relies on peer review, automated policy checks, and staged rollouts rather than manual approval gates alone.

Runbooks document operational procedures for incidents, and post-incident reviews (blameless retrospectives) capture root causes and corrective actions.

A virtual private cloud (VPC) is an isolated virtual network defined by a CIDR block; subnets partition that block and are either public (routed to an internet gateway) or private (no direct inbound internet route).

CIDR notation: /24 provides 256 addresses, /25 provides 128, /26 provides 64, /27 provides 32, and /28 provides 16; cloud providers reserve some addresses in each subnet, so usable addresses are fewer than the raw count.

Security groups are stateful virtual firewalls attached to instances; network ACLs are stateless and apply at the subnet boundary, requiring explicit rules for both directions.

A NAT gateway allows instances in private subnets to initiate outbound internet connections without accepting inbound connections.

Site-to-site VPN connects on-premises networks to a VPC over the public internet using IPsec; dedicated private circuits provide more consistent latency and bandwidth at higher cost.

DNS resolution in cloud environments uses hosted zones; record types include A (IPv4), AAAA (IPv6), CNAME (alias), and MX (mail).

Load balancers distribute traffic at layer 4 (TCP/UDP) or layer 7 (HTTP/HTTPS with path and host routing); health checks remove unhealthy targets from rotation.

Content delivery networks (CDNs) cache content at edge locations, reducing latency and origin load; cache invalidation and TTL settings control freshness.

Storage types: object storage (unstructured data accessed via HTTP API, effectively unlimited scale), block storage (attached to a single compute instance, low latency), and file storage (shared network file system with POSIX semantics).

Durability is the probability that data is not lost; availability is the percentage of time the service is usable; these are distinct metrics and should not be conflated.

Storage tiers balance cost and access frequency: hot/standard for frequent access, infrequent-access tiers for monthly access, archive tiers for long-term retention with retrieval delays, and deep archive for the lowest cost and slowest retrieval.

Lifecycle policies automatically transition objects between tiers or delete them after a defined age, reducing manual management and cost.

Replication options include synchronous replication (zero data loss, higher latency) and asynchronous replication (lower latency, nonzero RPO); cross-region replication supports disaster recovery.

Relational databases enforce schemas and ACID transactions; NoSQL databases trade some consistency for horizontal scale and flexible schemas (key-value, document, wide-column, graph).

The CAP theorem states that a distributed data store cannot simultaneously guarantee consistency, availability, and partition tolerance; under a network partition, a system must choose consistency or availability.

Data governance includes cataloging, lineage tracking, access controls, and retention schedules; data residency requirements may restrict where data can be stored or replicated.

The pay-as-you-go model bills based on metered consumption; reserved or committed-use pricing offers discounts in exchange for a one- or three-year commitment.

Spot or preemptible instances offer the largest discounts but can be reclaimed with little notice; they suit fault-tolerant, interruptible workloads.

Rightsizing matches instance size and type to actual utilization; consistently low CPU and memory utilization indicates overprovisioning.

Cost allocation uses tags (e.g., cost center, project, environment) to attribute spend; untagged resources are a common source of unallocated cost.

Budgets and alerts notify stakeholders when spend or forecast exceeds thresholds; anomaly detection flags unexpected cost spikes.

Governance controls include service quotas, policy-as-code guardrails (e.g., deny creation of unapproved instance types), and approval workflows for expensive resources.

Total cost of ownership includes direct cloud charges plus egress fees, support plans, licensing, and migration or training costs; data egress is frequently underestimated.

Showback reports costs to teams without charging them; chargeback actually bills internal teams, which tends to drive stronger cost accountability.