ACA CCO flashcards

40 cards. Read the term and the definition here. The deck at the top of this page is optional.

Elasticity vs scalability

Elasticity is automatic, rapid matching of capacity to current demand in both directions. Scalability is the ability to grow capacity at all, vertically by resizing or horizontally by adding instances.

Shared responsibility model

The provider secures facilities, hardware, hypervisor, and managed-service internals. The customer secures guest OS patching, data, identities, access policy, and configuration of resources they control.

Availability Zone

A physically isolated location within a Region with independent power and network. Deploying across multiple AZs lets an application survive the failure of a single data center.

Region selection factors

Choose a Region by proximity to users for latency, legal data-residency requirements, service availability, and price. Resources in different Regions are independent and communicate only over the internet or dedicated links.

SLA credit meaning

A service level agreement states an uptime target and the credits owed if it is missed. Credits are financial remedies, not guarantees of availability or of data durability.

Horizontal vs vertical scaling

Horizontal scaling adds or removes instances and is limited mainly by application statelessness. Vertical scaling resizes one instance and is capped by the largest available instance type.

ECS instance lifecycle

Instances move Pending to Running, can be Stopped and Started again, and finally Released. Release destroys the instance, while Stop preserves disks and configuration for later restart.

Security group behavior

A stateful, instance-level virtual firewall that supports allow rules only. Return traffic for an established permitted connection is automatically allowed without an explicit egress rule.

User data execution

A script supplied at instance creation and executed once by cloud-init on first boot. Rebooting or editing the user data later does not cause it to run again.

Instance metadata service

A link-local endpoint reachable from inside the guest that returns instance ID, Region, and temporary role credentials. It is not reachable from outside the instance.

Auto Scaling components

A launch template defines how instances are created; scaling rules and a min/max/desired capacity triple define how many exist at any moment.

Stop versus restart

Restart preserves runtime state, memory-resident configuration, and all IP addresses. Stop halts billing for compute and may release a non-static public IP on the next start.

Instance family selection

Match CPU-to-memory ratio to workload: balanced for web tiers, compute-optimized for batch and encoding, memory-optimized for caches and in-memory databases, GPU for parallel compute.

Custom image

A reusable template built from a system disk snapshot plus configuration, used to launch identical instances with preinstalled software and consistent baseline settings.

VPC and vSwitch scope

A VPC spans one Region; each vSwitch (subnet) belongs to exactly one Availability Zone. An instance's subnet therefore determines its AZ.

Internet versus NAT gateway

An internet gateway gives instances with public IPs bidirectional internet access. A NAT gateway gives private-subnet instances outbound-only access and blocks unsolicited inbound connections.

Security group vs network ACL

Security groups are stateful and attach to instances with allow-only rules. Network ACLs are stateless, attach to subnets, and evaluate numbered allow and deny rules in order.

Longest prefix route match

When several route table entries match a destination, the most specific prefix wins. A /24 route therefore overrides a 0.0.0.0/0 default route for matching addresses.

Layer 4 versus layer 7 LB

Layer 4 balances TCP/UDP flows, preserves source IP, and offers high throughput. Layer 7 understands HTTP, enabling host and path routing, TLS termination, and cookie stickiness.

CDN cache hit ratio

The share of requests served from edge nodes instead of the origin. It rises with longer TTLs and cacheable content, lowering origin load and user latency.

Overlapping CIDR effect

Two VPCs with overlapping address ranges cannot be peered, because routing would be ambiguous. Address space must be planned to be unique across networks intended to connect.

Object versus block storage

Object storage is a flat bucket-plus-key namespace for unstructured data, accessed over HTTP. Block storage is a volume attached to one instance, used for file systems and databases.

Durability versus availability

Durability is the annual probability that stored data is not lost. Availability is the fraction of time the service is reachable. A store can be highly durable yet briefly unavailable.

Snapshot incrementality

The first snapshot copies full volume data; later snapshots store only changed blocks. Snapshots persist independently, so deleting the source volume does not delete them.

Read replica characteristics

An asynchronous copy of a primary database that serves read traffic and offloads queries. Replication lag means replicas may return slightly stale data.

SQL versus NoSQL tradeoff

Relational databases enforce schema and ACID transactions and scale mainly vertically with read replicas. NoSQL stores scale horizontally but typically relax joins and strong consistency.

Provisioned IOPS volumes

Block volumes where performance is specified independently of capacity. They suit latency-sensitive databases, unlike burst-capable types that exhaust credits under sustained load.

Lifecycle rules

Object storage policies that transition objects to colder tiers or expire them based on age or prefix. They reduce cost for infrequently accessed data without application changes.

Explicit deny precedence

In access policy evaluation, any matching explicit deny overrides every allow. If no statement allows the request, the default result is an implicit deny.

Roles versus long-term keys

Roles are assumed temporarily and issue short-lived STS credentials that expire automatically. Long-term access keys persist until rotated manually and are a common breach vector.

Envelope encryption

A data key encrypts the payload, and a master key encrypts the data key. Rotating the master key limits the blast radius of compromise without re-encrypting all data.

Least privilege policy

Grant only the actions required, scoped to specific resource identifiers. Wildcard actions paired with wildcard resources effectively grant full account access and defeat the principle.

Federated identity

An external identity provider authenticates users, who then assume a role and receive scoped temporary credentials. No separate cloud account or long-term key is needed per user.

Alarm evaluation states

An alarm is OK, in ALARM, or INSUFFICIENT_DATA. It enters ALARM when a metric breaches the threshold for a configured number of consecutive evaluation periods.

Four golden signals

Latency, traffic, errors, and saturation. Monitoring these four covers user-visible health for most services and guides which metric to alert on first.

Percentile versus average latency

An average hides slow tail requests that affect real users. Alerting on p95 or p99 latency surfaces degradation that a mean value would mask.

Connectivity troubleshooting order

Check security group rules, then network ACLs, then route table next hop, then public IP or NAT presence, then the guest firewall, and finally DNS resolution.

Infrastructure as code drift

Drift is divergence between declared configuration and actual deployed state, often from manual console changes. A plan or diff step detects it before the next apply.

Logs metrics traces

Logs record discrete events for a request, metrics record aggregated numeric trends over time, and traces record timing across the call graph. Each answers a different question.

Event-driven automation

Automation triggered by a state change or alarm rather than a schedule. It reacts within seconds to failures such as an unhealthy instance or a breached threshold.