SAE-C01 (Alibaba Cloud Certifications) cheat sheet

Shared responsibility model: provider secures the cloud (facilities, hardware, hypervisor); customer secures what is in the cloud (data, identities, configuration).

IaaS gives the customer OS and above; PaaS gives runtime and above; SaaS gives only data and configuration control.

Availability zones are isolated data-center groups within one region; multi-AZ deployments tolerate a single-AZ failure without downtime.

Regions are independent geographic areas; data residency requirements are met by choosing the region where data is stored and processed.

Elasticity scales resources to match demand automatically; scalability is the capacity to grow, elasticity is the automation of that growth and shrinkage.

High availability minimizes downtime via redundancy; disaster recovery restores service after a large failure and is measured by RTO (time) and RPO (data loss).

Vertical scaling adds capacity to one instance; horizontal scaling adds instances and requires stateless or externally stored session state.

Well-architected pillars: operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability.

Least privilege: grant only permissions required for the task; use roles and temporary credentials rather than long-lived access keys.

Encryption at rest protects stored data; encryption in transit protects data on the network via TLS; both are typically required by compliance frameworks.

Customer-managed keys give control over rotation and revocation; provider-managed keys reduce operational burden but limit control.

Identity federation via SAML or OIDC lets users authenticate to the cloud with existing corporate credentials, avoiding duplicate identity stores.

Multi-factor authentication combines something you know with something you have; it mitigates credential-stuffing and phishing-driven account takeover.

Audit trails (API activity logs) are immutable records of who did what and when; they support forensics and compliance evidence.

Defense in depth layers controls: network segmentation, identity, encryption, host hardening, and monitoring, so one failed layer does not expose data.

A compliance report or attestation (e.g., SOC 2, ISO 27001) documents controls; inheriting provider attestations reduces the customer's audit scope.

Infrastructure as code makes environments reproducible; idempotent templates converge to the declared state regardless of starting state.

Blue/green deployment shifts traffic to a new environment and rolls back by reverting the traffic switch; canary releases shift a small percentage first.

Rolling deployment replaces instances in batches, keeping capacity above a defined minimum; it trades speed for reduced blast radius.

Immutable infrastructure replaces instances rather than patching them, eliminating configuration drift.

CI builds and tests artifacts; CD promotes the same tested artifact through environments, so build once and deploy many times.

Tagging resources by owner, environment, and cost center enables cost allocation and automated lifecycle policies.

Autoscaling policies based on CPU, memory, or queue depth need cooldown periods to avoid oscillation.

Runbooks document repeatable operational procedures; post-incident reviews capture root cause and corrective actions without blame.

CIDR notation /24 means 256 addresses, /25 means 128, /26 means 64; usable hosts are total minus network and broadcast in traditional subnets.

A public subnet routes to an internet gateway; a private subnet reaches the internet only through a NAT gateway or proxy.

Security groups are stateful instance-level firewalls: return traffic is automatically allowed, and rules are allow-only.

Network ACLs are stateless subnet-level filters evaluated in numbered order; both inbound and outbound rules must be defined explicitly.

A VPC peering connection connects two VPCs privately; it is non-transitive, so A-to-B and B-to-C do not give A-to-C.

A transit gateway or hub-and-spoke design centralizes connectivity among many VPCs and on-premises networks.

DNS resolution maps names to addresses; private hosted zones resolve internal names only within associated VPCs.

A load balancer distributes traffic across targets and performs health checks; unhealthy targets are removed from rotation.

Object storage is key-value with eventual or strong consistency depending on service; block storage is a volume attached to one instance; file storage is a shared hierarchical filesystem.

Durability is the probability data is not lost; availability is the percentage of time data is accessible. Eleven nines durability does not imply eleven nines availability.

Storage tiers trade retrieval latency and cost: hot for frequent access, infrequent-access for occasional, archive for rare with minutes-to-hours restore.

Lifecycle policies transition objects between tiers or expire them after a defined age, controlling cost automatically.

Snapshots are incremental point-in-time copies; the first is full and later ones store only changed blocks.

RAID or replicated volumes improve durability and read throughput but are not a substitute for backups.

Backups must be tested by restore; an untested backup is an assumption, not a recovery capability.

Relational databases enforce schema and ACID transactions; NoSQL key-value or document stores scale horizontally at the cost of joins and strong multi-item guarantees.

Metrics are numeric time-series (CPU, latency); logs are discrete events; traces follow one request across services.

SLI is the measured indicator, SLO is the target for that indicator, and SLA is the contractual commitment with consequences.

Error budget equals 1 minus SLO; exhausting it triggers a freeze on risky changes until reliability recovers.

The four golden signals are latency, traffic, errors, and saturation.

Percentile latency (p95, p99) reveals tail behavior that averages hide; averages can mask a slow minority of requests.

Alert on symptoms users feel (error rate, latency) rather than every underlying cause to reduce alert fatigue.

Centralized log aggregation with structured fields enables correlation across services; retention policies balance cost and investigation needs.

Distributed tracing uses a trace ID propagated across services to locate the slow or failing hop in a request path.

Troubleshooting order: confirm scope and blast radius, check recent changes, then isolate the layer (network, compute, storage, application).

Symptom-versus-cause: a 5xx spike may be caused by database connection exhaustion, not by the load balancer.

Health checks failing on all instances usually indicates a shared dependency (DNS, database, credentials) rather than per-instance faults.

Correlate timestamps across logs in a common time zone (UTC) to establish event ordering.

Timeouts and retries with exponential backoff and jitter prevent retry storms; cap total retry attempts.

A circuit breaker opens after repeated failures and fails fast, protecting downstream services from overload.

Log levels: DEBUG for development detail, INFO for normal events, WARN for recoverable anomalies, ERROR for failed operations.

Reproduce in a lower environment only after capturing evidence; changing production before collecting logs destroys forensic data.

Dashboards answer known questions; ad hoc queries investigate new incidents; keep both, but alert only from reliable signals.

Synthetic monitoring probes endpoints from outside to detect availability problems before users report them.

Metric aggregation intervals affect resolution: a 5-minute average can hide a 30-second outage.

Log sampling reduces volume but can drop the rare error you need; sample high-volume success logs, keep all errors.

Root cause analysis distinguishes trigger (the change that started it) from underlying condition (why the system was vulnerable).

Capacity alerts should fire on trend projection, not only on current utilization thresholds.

Audit logs and application logs serve different purposes; audit logs record control-plane changes, application logs record request behavior.

Retention and access controls on logs are security requirements because logs can contain personal or secret data.