SAE-C01 (Alibaba Cloud Certifications) flashcards
SAE-C01 · Build recall with a focused review session.
33 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Shared responsibility model
- A division of security duties: the cloud provider secures facilities, hardware, and virtualization, while the customer secures data, identities, access, and configuration.
- Availability zone
- An isolated data-center group within a region with independent power and networking. Deploying across zones lets an application survive a single-zone failure.
- Elasticity versus scalability
- Scalability is the capacity to handle growth; elasticity is the automated addition and removal of capacity to match current demand, often within minutes.
- RTO and RPO
- Recovery time objective is the maximum acceptable downtime after a failure; recovery point objective is the maximum acceptable data loss measured in time.
- Horizontal versus vertical scaling
- Horizontal adds more instances and needs stateless design; vertical adds CPU or memory to one instance and is limited by the largest available size.
- Least privilege
- Granting only the permissions required for a specific task, reducing the blast radius if credentials are compromised or misused.
- Encryption in transit
- Protecting data on the network using TLS so intercepted traffic cannot be read. It complements, but does not replace, encryption at rest.
- Customer-managed keys
- Encryption keys the customer creates and controls, allowing independent rotation and revocation, but requiring the customer to manage key policy and availability.
- Identity federation
- Trusting an external identity provider via SAML or OIDC so users sign in with existing corporate credentials instead of a separate cloud account.
- Multi-factor authentication
- Requiring two independent credential factors, such as a password plus a one-time code, which blocks most credential-stuffing and phishing account takeovers.
- Stateful security group
- An instance-level firewall that automatically permits return traffic for allowed outbound or inbound flows, and supports only allow rules.
- Stateless network ACL
- A subnet-level filter evaluated in numbered order that requires explicit inbound and outbound rules because return traffic is not automatically permitted.
- VPC peering non-transitivity
- A peering link connects exactly two networks. If A peers with B and B with C, A cannot reach C unless a direct link or transit hub exists.
- Public versus private subnet
- A public subnet routes to an internet gateway; a private subnet has no direct inbound route and reaches the internet only through NAT or a proxy.
- Load balancer health checks
- Periodic probes of backend targets. Targets failing the probe are removed from rotation, so traffic goes only to healthy instances.
- Infrastructure as code
- Declaring infrastructure in versioned templates so environments are reproducible and idempotent, converging to the declared state on each run.
- Blue/green deployment
- Running two identical environments and switching traffic from old to new at once. Rollback is a fast traffic switch back to the old environment.
- Canary release
- Routing a small percentage of traffic to a new version first, then increasing it gradually while monitoring error rates and latency.
- Immutable infrastructure
- Replacing instances with freshly built images instead of patching running servers, which eliminates configuration drift over time.
- Build once, deploy many
- A CI/CD rule that the exact artifact tested in staging is promoted unchanged to production, ensuring what was verified is what runs.
- Object storage
- A flat key-value store for unstructured data with high durability, accessed over HTTP APIs, and well suited to backups, media, and static assets.
- Block storage
- A volume presented to an instance as a raw disk, formatted with a filesystem by the OS, offering low latency for databases and boot volumes.
- Durability versus availability
- Durability is the probability stored data is not lost; availability is the fraction of time it can be accessed. High durability does not guarantee high availability.
- Storage lifecycle policy
- Rules that automatically transition objects to cheaper tiers or delete them after a defined age, reducing cost without manual intervention.
- Incremental snapshot
- A point-in-time copy where the first snapshot is full and later ones store only changed blocks, reducing storage cost and backup time.
- SLI, SLO, and SLA
- An SLI is the measured indicator, an SLO is the internal target for it, and an SLA is the contractual commitment with defined consequences.
- Error budget
- One minus the SLO. It is the allowed unreliability; when exhausted, teams typically freeze risky changes until reliability is restored.
- Four golden signals
- Latency, traffic, errors, and saturation: the four metrics that give broad visibility into a service's health and user experience.
- Tail latency percentiles
- p95 and p99 latency describe the slowest requests. Averages hide slow minorities, so percentiles better reflect user-perceived performance.
- Distributed tracing
- Propagating a trace identifier across services so one request's path is reconstructed, revealing which hop is slow or failing.
- Retry with exponential backoff
- Repeating a failed call after increasing delays with random jitter, preventing synchronized retry storms that overwhelm a recovering dependency.
- Circuit breaker pattern
- After repeated downstream failures, the breaker opens and fails requests immediately, protecting the failing service from further load while it recovers.
- Blast radius assessment
- Determining how many users, services, or regions an incident affects, which sets severity and whether to roll back immediately or investigate first.