SAE-C01 (Alibaba Cloud Certifications) key terms

A region is a geographic area containing multiple isolated data centers; availability zones are separate facilities within a region with independent power and networking, so workloads can survive a single-zone failure.

A division of duties in which the cloud provider secures the physical infrastructure and core services, while the customer secures their data, identities, configurations, and anything they build on top.

Tiers of managed service: infrastructure gives raw compute and storage, platform supplies a managed runtime for code, and software delivers a finished application. Each shifts more operational burden to the provider.

The ability to automatically add or remove resources as demand changes, so capacity tracks workload needs rather than being fixed to a peak estimate.

Adding more instances of a resource, such as additional servers behind a load balancer, rather than making a single server larger. It improves resilience as well as capacity.

Increasing the size or power of a single resource, such as moving to a larger instance type. It is simple but bounded by hardware limits and often requires downtime.

A control that adjusts the number of running instances based on metrics or schedules, maintaining performance during spikes and reducing cost during quiet periods.

A model where the provider manages servers entirely and runs code on demand, billing per invocation or execution time while scaling automatically to zero when idle.

A serverless compute offering in which a single function is deployed and triggered by events or requests, with the platform handling provisioning, scaling, and runtime patching.

The service and policies that define who can authenticate to a cloud environment and which actions they may perform on which resources, expressed through roles and policies.

A principle of granting only the permissions needed to complete a task, and only for as long as needed, limiting the blast radius if credentials are misused or compromised.

Temporarily obtaining credentials for a role with defined permissions, often across accounts, so long-lived access keys are not stored or shared.

Trusting an external identity provider to authenticate users, then issuing cloud credentials based on that assertion, so organizations can use existing directories and single sign-on.

Requiring a second proof of identity beyond a password, such as a one-time code or hardware key, which reduces the risk of account takeover from stolen credentials.

Protecting stored data by encoding it with keys so that disks, buckets, and databases are unreadable without authorization, even if physical media is exposed.

Protecting data while it moves between systems using protocols such as TLS, preventing interception or tampering on networks between clients, services, and data stores.

A managed service for creating, storing, rotating, and auditing cryptographic keys, letting applications encrypt data without handling raw key material directly.

Storing credentials, API keys, and tokens in a controlled vault with access auditing and rotation, instead of hard-coding them in source code or configuration files.

A logically isolated network within a cloud provider where you define address ranges and route traffic, separating your resources from other tenants and the public internet.

A range of IP addresses within a virtual network, often designated public or private, that controls which resources can be directly reached from the internet.

A set of rules that determines where network traffic from a subnet or gateway is directed, such as to a local network, internet gateway, or inspection appliance.

A managed component that connects a virtual network to the public internet, allowing resources with public addresses to send and receive external traffic.

A service that lets instances in private subnets initiate outbound internet connections while preventing unsolicited inbound traffic from reaching them.

A stateful virtual firewall attached to resources that allows or denies traffic by protocol, port, and source, with return traffic automatically permitted for allowed connections.

A stateless subnet-level filter that evaluates inbound and outbound rules separately in order, providing a coarse additional layer of traffic control beyond security groups.

A component that distributes incoming requests across multiple targets, improving availability and enabling horizontal scaling by routing around unhealthy instances.

A periodic probe that tests whether a target responds correctly, so load balancers and scaling systems can stop sending traffic to or replace failing instances.

A network interface that connects a virtual network privately to a managed service, keeping traffic off the public internet and reducing exposure.

A storage model that keeps data as discrete objects in flat namespaces with metadata and unique keys, well suited to unstructured content, backups, and static assets.

Storage presented as raw volumes attached to a compute instance, offering low-latency reads and writes for operating systems and databases that need a filesystem.

A point-in-time copy of a volume or database used for backup and recovery, typically stored incrementally so only changed blocks consume additional space.

Rules that automatically transition objects to cheaper tiers or delete them after a set age, controlling cost and retention without manual intervention.

The maximum acceptable amount of data loss measured in time, which determines how frequently backups or replication must occur to meet business requirements.

The maximum acceptable duration to restore a service after failure, guiding decisions about standby capacity, automation, and failover design.

The property of a system continuing to operate correctly when a component fails, usually achieved through redundancy and automatic failover with no service interruption.

Deploying workloads across more than one geographic region so that a regional outage does not take down the service, at the cost of added complexity and data synchronization.

Defining cloud resources in version-controlled template or configuration files so environments are created repeatably, reviewed like code, and rebuilt consistently.

A practice of replacing servers rather than modifying them in place, so every deployment starts from a known image and configuration drift is eliminated.

An automated sequence that builds, tests, and deploys changes, giving fast feedback and repeatable releases while reducing manual error in delivery.

Running two identical environments and shifting traffic from the old to the new one after validation, enabling fast rollback if the release misbehaves.

Sending a small fraction of traffic to a new version before full rollout, so problems surface with limited impact and can be reverted quickly.

The degree to which a system's internal state can be inferred from its outputs, combining metrics, logs, and traces to diagnose issues that were not anticipated.

Collecting logs from many services into one searchable store with retention rules, so engineers can correlate events across components instead of checking hosts individually.

Recording a request's path across services with shared identifiers, revealing where latency or errors originate in a multi-service call chain.

Rules that notify responders when a metric or log pattern crosses a threshold, ideally tied to user-facing symptoms rather than every underlying fluctuation.

A design where components emit and react to events through a broker or queue, decoupling producers from consumers and smoothing load spikes.

A durable buffer that holds messages until consumers process them, providing decoupling and backpressure so producers are not blocked by slow consumers.

A property where repeating the same operation produces the same result, which is essential in distributed systems where retries and duplicate deliveries are expected.

A retry strategy that increases the wait between attempts, often with random jitter, to avoid overwhelming a struggling service or hammering a throttled API.

Deliberately limiting the rate of requests a service accepts, protecting shared resources from overload and enforcing fair use across clients.

Policies that define how long data, logs, and backups are kept before deletion, balancing compliance obligations against storage cost and privacy risk.

The practice of matching resource size, purchasing model, and storage tier to actual demand, eliminating idle capacity while preserving required performance and resilience.