CCP (Other exams) flashcards
CCP · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- NIST essential characteristics
- The five characteristics defined by NIST SP 800-145: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service.
- IaaS responsibility boundary
- In IaaS the provider manages physical infrastructure, virtualization, and networking; the customer manages the guest operating system, middleware, runtime, applications, and data.
- Horizontal vs vertical scaling
- Horizontal scaling adds or removes instances to distribute load; vertical scaling increases or decreases the resources (CPU, memory) of a single instance.
- High availability percentage
- Availability is uptime divided by total time. 99.9% allows about 8.77 hours of downtime per year; 99.99% allows about 52.6 minutes per year.
- Hybrid cloud
- A deployment combining two or more distinct cloud models (private, public, or community) bound by technology that enables data and application portability between them.
- Loose coupling
- An architecture principle where components interact through asynchronous interfaces such as queues, so a failure in one component does not cascade to others.
- Shared responsibility model
- A division of security duties: the provider secures the cloud infrastructure, while the customer secures data, identities, configurations, and, in IaaS, the guest OS.
- Least privilege
- A security principle granting identities only the permissions necessary to perform their required tasks, minimizing the potential impact of compromised credentials.
- Identity federation
- A configuration using standards such as SAML 2.0 or OIDC so users authenticate with a corporate identity provider and receive temporary cloud credentials.
- Encryption in transit
- Protecting data moving across networks using protocols such as TLS 1.2 or higher, preventing interception or tampering between endpoints.
- SOC 2
- An audit report based on trust services criteria covering security, availability, processing integrity, confidentiality, and privacy of a service organization's systems.
- Data classification
- Assigning data to categories such as public, internal, confidential, or restricted to determine required controls, encryption, access, and retention.
- Infrastructure as Code
- Managing infrastructure through versioned definition files; declarative tools converge to a desired state, while imperative tools execute ordered commands.
- Immutable infrastructure
- A practice of replacing servers with new instances rather than modifying running ones, reducing configuration drift and simplifying rollback.
- Blue/green deployment
- A release strategy running two identical environments and switching traffic from the old (blue) to the new (green) after validation, enabling fast rollback.
- Recovery point objective
- The maximum acceptable amount of data loss measured in time; it determines backup frequency and replication lag tolerance.
- Recovery time objective
- The maximum acceptable duration to restore a service after a disruption; it drives redundancy, automation, and failover design choices.
- Golden signals
- Four monitoring metrics for distributed systems: latency, traffic, errors, and saturation, used to detect and diagnose service degradation.
- Error budget
- The allowable amount of unreliability, calculated as one minus the service level objective, used to balance release velocity against stability.
- VPC
- A virtual private cloud: an isolated virtual network defined by a CIDR block, partitioned into subnets that may be public or private.
- CIDR /24
- A subnet mask of 255.255.255.0 providing 256 total addresses; cloud providers reserve some addresses, so usable addresses are fewer.
- Stateful vs stateless firewall
- A stateful security group automatically permits return traffic for allowed connections; a stateless network ACL requires explicit rules for both inbound and outbound directions.
- NAT gateway
- A managed service enabling instances in private subnets to initiate outbound internet connections while blocking unsolicited inbound connections.
- Layer 7 load balancer
- A load balancer that routes HTTP/HTTPS traffic based on application-level attributes such as path, host header, or cookies.
- Object storage
- Storage for unstructured data accessed via HTTP APIs, offering effectively unlimited scale and metadata, but not suitable for in-place block-level modification.
- Block storage
- Storage presented as raw volumes attached to a compute instance, providing low-latency access suitable for databases and file systems.
- Storage lifecycle policy
- A rule that automatically transitions objects between storage tiers or deletes them after a defined age, reducing manual management and cost.
- CAP theorem
- A distributed data store cannot simultaneously guarantee consistency, availability, and partition tolerance; under a partition it must sacrifice one of the first two.
- Durability vs availability
- Durability is the probability data is not lost over time; availability is the percentage of time the service is usable. They are distinct metrics.
- Reserved instances
- A pricing model committing to a one- or three-year term in exchange for a discount over on-demand rates, suited to steady-state workloads.
- Spot instances
- Compute capacity offered at steep discounts that can be reclaimed with little notice, suitable for fault-tolerant or interruptible workloads.
- Cost allocation tags
- Metadata labels such as cost center, project, or environment attached to resources to attribute cloud spend to the correct owner.