Alibaba CSA-C01 cheat sheet

Alibaba Cloud's global footprint is organized into regions (geographic areas) and zones (isolated data centers with independent power and network within a region).

Regions are selected for latency, data residency/compliance, and service availability; not all products or instance types are offered in every region.

Multi-zone deployment protects against single data-center failure; a zone failure does not affect other zones in the same region.

IaaS provides compute, storage, and networking; PaaS provides managed runtimes and middleware; SaaS provides finished applications.

Alibaba Cloud core product families: ECS (compute), VPC/SLB/CDN (networking), OSS/NAS/Disk (storage), ApsaraDB (databases), RAM (identity), CloudMonitor (observability).

Public cloud, hybrid cloud, and dedicated cloud are the main deployment models Alibaba Cloud supports.

The shared responsibility model: Alibaba Cloud secures the physical infrastructure and virtualization layer; customers secure their guest OS, applications, data, and RAM permissions.

Elasticity means resources scale on demand; scalability means architecture can grow without redesign; both are core cloud value propositions.

Alibaba Cloud's self-service console, OpenAPI, and CLI provide programmatic control over resources in all regions.

ECS instance families: general purpose (g), compute optimized (c), memory optimized (r), big data (d), local SSD, GPU/FPGA, and shared vs. dedicated tenancy.

Billing modes: Subscription (prepaid, usually cheapest for steady long-term workloads), Pay-As-You-Go (per-second/hourly), and Spot/Preemptible instances (low cost, can be reclaimed).

Instance types are named like ecs.g7.large: family letter, generation number, and size suffix determining vCPU and memory.

A security group is a stateful virtual firewall attached to ECS instances; rules are allow-only, and separate inbound and outbound rule sets apply.

An image captures the OS and software configuration; custom images enable repeatable instance provisioning and can be shared across accounts.

A key pair (SSH) replaces password login for Linux instances; passwords or key pairs authenticate Windows instances via RDP.

User data scripts run at first boot to automate configuration; instance metadata service exposes instance identity and attributes from inside the VM.

ECS instances can attach cloud disks (system and data), and snapshots of disks enable backup and rollback.

Auto Scaling automatically adjusts ECS instance count based on scaling rules and CloudMonitor metrics to match demand.

A VPC is an isolated virtual network with a user-defined private CIDR block; subnets divide the VPC into zones.

VSwitches are subnet resources bound to a single zone; instances in different VSwitches within one VPC can communicate privately by default.

Security groups and network ACLs both control traffic; security groups are instance-level and stateful, network ACLs are subnet-level and stateless.

A NAT Gateway lets instances in a private subnet access the internet without public IPs; an Internet NAT Gateway handles outbound, a DNAT entry enables inbound.

SLB (Server Load Balancer) distributes traffic across backend servers; types include CLB (classic/application), ALB (application layer), and NLB (network layer).

SLB health checks remove unhealthy backends from rotation; listeners define protocol and port mapping (e.g., TCP:80, HTTP:443).

Alibaba Cloud DNS (AliDNS) provides authoritative DNS hosting; PrivateZone resolves internal names within a VPC.

CDN caches content at edge nodes close to users; cache expiration and refresh rules control content freshness and origin pull behavior.

An EIP (Elastic IP) is a public IP that can be detached and re-attached to different instances; bandwidth is billed separately.

OSS (Object Storage Service) offers three storage classes: Standard, Infrequent Access, and Archive, with decreasing cost and increasing retrieval latency.

OSS buckets are region-scoped, globally unique in name, and support versioning, lifecycle rules, and cross-region replication.

NAS (Network Attached Storage) provides shared file-level storage mountable by multiple ECS instances concurrently; suited for shared workloads.

Cloud disk types include ESSD, SSD, and efficient cloud disks, differing in IOPS and throughput; snapshots back up disks.

ApsaraDB RDS is a managed relational database (MySQL, SQL Server, PostgreSQL, MariaDB) with automatic backup, failover, and read-only instances.

PolarDB is a cloud-native database with compute-storage separation, read replicas, and high performance; compatible with MySQL and PostgreSQL.

ApsaraDB for Redis is a managed in-memory cache for high-throughput, low-latency access patterns.

ApsaraDB for MongoDB is a managed document database for flexible schemas and horizontal scaling.

Lifecycle policies on OSS automatically transition or delete objects based on age, reducing storage cost.

Security groups implement network access control; default deny for inbound, and rules are evaluated as allow rules only.

Anti-DDoS Basic is included by default; Anti-DDoS Pro/Premium provides higher mitigation capacity for public-facing services.

Web Application Firewall (WAF) protects HTTP/HTTPS applications against SQL injection, XSS, and other OWASP-class attacks.

Cloud Firewall provides centralized north-south traffic control across VPCs and internet boundaries.

Security Center (Cloud Security Center) provides host-based threat detection, vulnerability scanning, and baseline checks.

Data encryption: OSS supports server-side encryption; RDS supports TDE; KMS manages encryption keys.

SSL/TLS certificates secure traffic in transit; Alibaba Cloud offers managed certificate services.

Least privilege and separation of duties are core principles; RAM policies enforce them at the API level.

Audit logs (ActionTrail) record API calls for security investigation and compliance.

RAM (Resource Access Management) manages users, groups, roles, and policies for Alibaba Cloud accounts.

A RAM user is an identity within an Alibaba Cloud account; a RAM role is assumed by trusted entities (users, services, or federated identities).

Policies are JSON documents with Effect (Allow/Deny), Action, Resource, and Condition; Deny overrides Allow.

System policies are predefined by Alibaba Cloud; custom policies are user-defined for fine-grained control.

STS (Security Token Service) issues temporary credentials for RAM roles, enabling short-lived access without long-term keys.

AccessKeys (AccessKeyId + AccessKeySecret) authenticate API/CLI calls; rotate and never embed them in code or public repositories.

MFA (multi-factor authentication) can be enforced for RAM users to strengthen login security.

Resource groups and tags enable organizing and scoping permissions across resources.

The root account should be used sparingly; create RAM users for day-to-day operations and enable MFA on the root.

CloudMonitor collects metrics (CPU, memory, disk, network) and supports alarms, event monitoring, and dashboards.

Alarm rules trigger notifications or actions (e.g., Auto Scaling) when a metric crosses a threshold for a defined period.

CloudMonitor agent must be installed on ECS to collect OS-level metrics like memory and process data.

ActionTrail records API activity for auditing and compliance; logs can be delivered to OSS or Log Service.

Log Service (SLS) ingests, queries, and analyzes logs in real time; supports alerting and dashboards.

Resource Orchestration Service (ROS) provisions infrastructure as code via templates, enabling repeatable deployments.

Operation Orchestration Service (OOS) automates routine operational tasks such as patching and runbooks.

Health status and event notifications surface platform-level events (e.g., instance maintenance) to operators.

Tagging resources supports cost allocation, inventory, and automation scoping.

Billing models include Subscription (prepaid), Pay-As-You-Go (postpaid), and Spot pricing; mixing them optimizes cost.

Alibaba Cloud issues coupons and discounts; Reserved Instance and Savings Plans reduce cost for predictable workloads.

The billing console shows bills by product, region, and tag; cost allocation tags attribute spend to teams or projects.

Free tier / free trial quotas exist for many products; exceeding them incurs charges.

Support plans: Basic (free), Developer, Business, and Enterprise, each with different response times and channels.

A support ticket is the primary channel for technical issues; severity determines response SLA.

Service quotas (limits) apply per region and product; request increases via the console or support.

The Trust Center publishes compliance certifications and security documentation.

Cost optimization levers: right-sizing, reserved capacity, storage lifecycle, and shutting down idle resources.

Design for high availability: deploy across multiple zones, use SLB health checks, and avoid single points of failure.

Design for elasticity: use Auto Scaling with CloudMonitor metrics to match capacity to demand.

Decouple components with message queues (Message Queue/MQ) and asynchronous processing to improve resilience.

Use caching (Redis) in front of databases to reduce latency and database load.

Stateless application tiers scale horizontally; store session state externally (e.g., Redis) rather than on instances.

Use CDN and OSS for static content to offload origin and reduce latency for global users.

Design for security in depth: VPC isolation, security groups, WAF, RAM least privilege, and encryption.

Choose managed services (RDS, OSS, SLB) to reduce operational burden where appropriate.

Plan for disaster recovery with cross-region replication and tested backup/restore procedures.

The CSA-C01 exam covers cloud fundamentals, ECS, networking, storage/databases, security, RAM, monitoring, billing, support, and architecture.

Questions often present a scenario and ask for the most appropriate Alibaba Cloud product or configuration.

Know the difference between security groups (stateful, instance-level) and network ACLs (stateless, subnet-level).

Know when to choose OSS vs. NAS vs. cloud disk based on access pattern (object vs. shared file vs. block).

Know when to choose RDS vs. PolarDB vs. Redis vs. MongoDB based on workload characteristics.

Understand RAM policy structure and the Deny-overrides-Allow rule.

Understand billing models and cost optimization levers.

Understand multi-zone and multi-region design for availability and disaster recovery.

Read each scenario carefully to identify the constraint (cost, latency, compliance, availability) driving the answer.