ACA CCP flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

NIST cloud characteristics

Five essential traits: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. These distinguish true cloud from traditional hosting.

IaaS vs PaaS

IaaS delivers virtual machines, storage, and networks that the customer configures. PaaS adds a managed runtime and middleware, so the customer deploys code while the provider patches the platform.

Multi-zone deployment

Placing resources in separate zones within one region. Zones have independent power and networking, so a zone failure does not take down the whole application.

Vertical vs horizontal scaling

Vertical scaling resizes an existing instance (more CPU or memory). Horizontal scaling adds or removes instances. Horizontal scaling better supports elasticity and fault tolerance.

CAP theorem

During a network partition a distributed system must sacrifice either consistency or availability. Designers choose based on whether stale reads or failed writes are more acceptable.

Shared responsibility model

The provider secures facilities, hardware, hypervisor, and managed-service infrastructure. The customer secures data, identities, access policy, and guest operating system configuration.

Preemptible ECS instances

Spot-like ECS capacity offered at a large discount that can be reclaimed by the provider. Suitable for fault-tolerant batch jobs, not for stateful production workloads.

ECS instance families

Families are typed by workload: general purpose balances CPU and memory, compute optimized favors CPU, memory optimized favors RAM, and others target storage or GPU needs.

Security group behavior

A stateful virtual firewall attached to ECS instances. Rules are allow-only, return traffic is automatically permitted, and one instance may join multiple security groups.

OSS bucket naming

Bucket names must be globally unique across all Alibaba Cloud accounts, because the bucket name forms part of the object's public endpoint URL.

OSS storage classes

Standard, Infrequent Access, Archive, and Cold Archive. Cost decreases and retrieval time and minimum storage duration increase from Standard toward Cold Archive.

VPC and vSwitch

A VPC is an isolated private network defined by a CIDR block. vSwitches are subnets inside it, each bound to exactly one zone, where ECS and RDS are deployed.

Server Load Balancer

A managed traffic distributor that spreads requests across backend servers and removes unhealthy ones via health checks. Layer 7 variants route HTTP/HTTPS by URL or host.

Auto Scaling components

A scaling group defines which instances to manage, a scaling configuration defines the instance template, and scaling rules or alarms trigger adding or removing capacity.

RDS read-only instance

A managed replica of an ApsaraDB RDS primary that serves read queries. It offloads reporting and read-heavy traffic from the primary database.

RAM role

An identity assumed by trusted entities such as ECS instances or federated users. It grants temporary credentials so long-term access keys need not be distributed.

RAM policy structure

A JSON document with Effect (Allow or Deny), Action, Resource, and optional Condition. An explicit Deny always overrides any Allow statement.

STS temporary credentials

Security Token Service issues short-lived credentials bounded by a validity period and a policy. Used for federation and for granting applications scoped temporary access.

KMS envelope encryption

A customer master key encrypts a data key, and the data key encrypts the data. Rotating or protecting the master key does not require re-encrypting all data.

Anti-DDoS and WAF

Anti-DDoS scrubs volumetric network-layer attack traffic. Web Application Firewall filters HTTP/HTTPS attacks such as SQL injection and cross-site scripting.

ActionTrail

A service that records API calls made in an account, including caller identity, time, and source IP, supporting audit, compliance, and forensic investigation.

Root account protection

The account owner identity has full privileges. Best practice is to enable MFA, avoid daily use, and perform operations through RAM users and roles instead.

Network ACL vs security group

A network ACL filters traffic at the subnet level and is stateless, requiring both inbound and outbound rules. A security group is stateful and applies at the instance level.

RTO and RPO

Recovery Time Objective is the maximum tolerable downtime. Recovery Point Objective is the maximum tolerable data loss, expressed as a time span of lost transactions.

3-2-1 backup rule

Keep three copies of data, on two different media types, with one copy stored offsite. Cloud snapshots plus cross-region replication implement this pattern.

Loose coupling with queues

Components communicate through a message queue instead of direct calls. Spikes are buffered, consumers scale independently, and a failing consumer does not block producers.

Blue-green deployment

Two identical environments run in parallel; traffic switches from blue to green after the new version passes health checks, and rollback is a switch back.

Canary release

A new version is exposed to a small percentage of traffic first. If error rates and latency stay acceptable, the percentage is gradually increased.

Health check role

Load balancers and Auto Scaling probe endpoints periodically. Failing instances are removed from rotation or replaced, containing faults without manual intervention.

Right-sizing

Matching instance CPU, memory, and disk to observed utilization. Over-provisioned instances waste cost; under-provisioned instances cause latency and errors.

Stateless application tier

Application servers hold no session state locally; sessions live in a shared store. Any instance can serve any request, enabling horizontal scaling and safe replacement.

Infrastructure as code

Defining cloud resources in version-controlled templates rather than manual console actions. It makes environments repeatable, reviewable, and recoverable after failure.