ACE-Professional flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Shared Responsibility Model

Division of security duties: the cloud provider secures physical facilities, hardware, and managed-service internals, while the customer secures data, identities, access configuration, and guest operating systems.

RTO versus RPO

Recovery Time Objective is the maximum acceptable outage duration; Recovery Point Objective is the maximum acceptable data loss measured in time before the failure.

Elasticity versus Scalability

Scalability is the maximum capacity a system can grow to; elasticity is the automated ability to add and remove capacity dynamically as demand rises and falls.

Availability Zone

An isolated data-center group within a region with independent power and networking, designed so a single zone failure does not affect others in the same region.

Loose Coupling

A design where components communicate through queues, events, or APIs rather than direct dependencies, so one component's failure or slowdown does not cascade.

Serverless Function Constraints

Event-driven code with no server management, but bounded execution time, cold-start latency, and ephemeral local storage; persistent state must live in external services.

Horizontal versus Vertical Scaling

Horizontal adds more instances behind a load balancer and needs stateless sessions; vertical resizes a single instance with more CPU or memory and often requires a restart.

Target Tracking Scaling

An autoscaling policy that adjusts capacity to hold a chosen metric, such as average CPU utilization, at a specified target value.

Containers versus Virtual Machines

Containers share the host kernel and package application plus dependencies with low overhead; virtual machines run a full guest OS, giving stronger isolation at higher resource cost.

Connection Draining

A load balancer behavior that stops sending new requests to a deregistering target while allowing in-flight requests to complete before removal.

Spot or Preemptible Capacity

Discounted compute that can be reclaimed by the provider with short notice; suitable only for interruptible, checkpointed, or fault-tolerant workloads.

Object versus Block Storage

Object storage stores key-addressed objects accessed over HTTP with effectively unlimited scale; block storage presents volumes attached to a single compute instance for file systems or databases.

Durability versus Availability

Durability is the probability stored data is never lost; availability is the percentage of time that data can be successfully read or written.

Storage Lifecycle Policy

Rules that automatically transition objects to colder tiers or delete them based on age, prefix, or tags, reducing cost without application changes.

RAID Levels

RAID 0 stripes without redundancy, RAID 1 mirrors, RAID 5 survives one disk failure, RAID 6 survives two, and RAID 10 combines mirroring with striping.

Snapshot versus Replication

Snapshots are incremental point-in-time copies taken on a schedule; replication continuously copies changes to another location, giving a much smaller recovery point objective.

Backup 3-2-1 Rule

Keep three copies of data, on two different media types, with one copy stored offsite; object lock or immutability protects backups from deletion or ransomware.

CIDR Address Math

Total addresses in a CIDR block equal 2^(32 minus prefix length); a /24 holds 256 addresses and a /16 holds 65,536, minus reserved network and broadcast addresses.

Security Group versus Network ACL

Security groups are stateful, allow-only filters attached to resources; network ACLs are stateless, ordered rules supporting explicit allow and deny at the subnet boundary.

NAT Gateway Purpose

Lets instances in a private subnet initiate outbound internet connections for updates or API calls while preventing unsolicited inbound connections from the internet.

VPN versus Dedicated Circuit

A site-to-site VPN is encrypted over the public internet with variable latency and low cost; a dedicated private circuit offers consistent latency and bandwidth at higher cost.

DNS Alias Record

A record type that maps a hostname directly to a provider resource such as a load balancer, resolving without an extra lookup and updating automatically if the target address changes.

VPC Peering Transitivity

Peering links two networks directly and is non-transitive: if A peers with B and B peers with C, A cannot reach C without its own peering or a transit hub.

Least Privilege

Granting only the actions, resources, and conditions needed for a task, using roles and short-lived credentials instead of broad or long-lived access keys.

Identity Federation

Authentication delegated to an external identity provider using SAML 2.0 or OIDC, after which users assume roles with temporary credentials rather than separate cloud passwords.

Envelope Encryption

A scheme where a data key encrypts the data and a root key held in a key management service or HSM encrypts the data key, enabling rotation without re-encrypting everything.

Defense in Depth

Layering independent controls across identity, network, host, application, and data so that compromise of any single layer does not expose the whole system.

Compliance Framework Mapping

SOC 2 covers trust services criteria, ISO 27001 defines an information security management system, PCI DSS covers cardholder data, HIPAA covers health data, and GDPR covers EU personal data.

Four Golden Signals

Latency, traffic, errors, and saturation; monitoring these four user-facing signals catches most service degradation more effectively than alerting on every raw metric.

SLI, SLO, and Error Budget

An SLI is a measured service indicator, an SLO is its target, and the error budget equals one minus the SLO, defining how much unreliability is acceptable.

Blue/Green Deployment

Running two identical environments and switching traffic from the old to the new one after validation, giving near-instant rollback by switching traffic back.

Canary Deployment

Releasing a new version to a small fraction of traffic first, monitoring error and latency metrics, then progressively expanding exposure or rolling back.