ACE-Specialist key terms

A preconfigured, governed cloud environment baseline that provides identity, networking, logging, and security controls so teams can deploy workloads consistently without rebuilding foundational setup.

An arrangement of folders, projects or subscriptions, and resources in a tree that lets administrators apply access and policy inheritance at the right scope.

A networking model where a central host project owns subnets and shares them with service projects, letting teams use common network controls while managing workloads separately.

A software-defined private network that provides IP addressing, routing, and isolation for cloud resources and controls which traffic can enter or leave.

Dividing a network into smaller trust zones with distinct access rules so a compromise in one area cannot spread freely to sensitive systems.

A security model that verifies every request using identity, device context, and policy instead of trusting users or systems merely because they sit inside a network perimeter.

A non-human identity used by applications, workloads, or automation to authenticate to cloud APIs and receive permissions through attached roles or policies.

A named collection of permissions that can be granted to users, groups, or service identities, often assumable temporarily rather than tied to a permanent credential.

Granting only the permissions needed to perform a task, for the shortest practical time and narrowest resource scope, to reduce accidental or malicious damage.

A trust configuration that lets external workloads exchange their own platform credentials for short-lived cloud credentials, avoiding long-lived service account keys.

Storing, distributing, rotating, and auditing sensitive values such as API keys and passwords in a controlled service instead of hard-coding them in source code or images.

Centralized creation, rotation, access control, and audit of cryptographic keys used to protect data at rest and in transit across cloud services.

Recording administrative and data-access events with identity, time, source, and outcome so investigators can reconstruct changes and prove compliance.

Recovery point objective is the maximum acceptable data loss measured in time; recovery time objective is the maximum acceptable downtime before service is restored.

Running or replicating workloads across separate geographic regions to survive a regional outage and, when paired with global routing, reduce user latency.

Copying data and configuration to a separate location on a schedule and proving that it can be recovered within required time and data-loss limits.

Rules that automatically transition, retain, or delete stored objects and backups after defined ages or conditions, controlling cost and compliance retention.

A service that distributes incoming traffic across healthy backends, performs health checks, and can provide global routing, TLS termination, and failover.

A periodic probe that tests whether a backend responds correctly; load balancers and autoscaling groups use results to route traffic or replace unhealthy instances.

Automatically adding or removing compute capacity based on demand signals such as CPU, queue depth, or custom metrics, within configured minimum and maximum limits.

A hardened, preconfigured machine image containing approved operating system settings and agents, used as the standard starting point for reproducible deployments.

Releasing a change to a small subset of users or traffic first, comparing error and latency signals, then expanding only if results remain acceptable.

Managing networks, compute, and platform services through versioned machine-readable definitions so environments can be recreated, reviewed, and changed repeatably.

Describing the desired end state of infrastructure rather than the step-by-step commands to reach it, allowing a tool to compute and apply the necessary changes.

A stored mapping between declared resources and real cloud objects, used to plan changes, detect drift, and avoid duplicate or destructive operations.

Comparing the actual configuration of deployed resources against the declared desired state to find unauthorized or accidental changes that need reconciliation.

Expressing security, compliance, and naming rules in machine-readable form so they can be tested, versioned, and enforced automatically during deployment.

An automated sequence that builds, tests, scans, and deploys changes through controlled stages, providing repeatability and fast feedback before production release.

A practice where servers or containers are replaced rather than modified in place, so every deployment starts from a known, reproducible artifact.

The ability to understand system behavior from logs, metrics, and traces, letting operators diagnose failures and performance issues without guessing.

A service level indicator is a measured signal such as latency or error rate; a service level objective is the target range set for that indicator.

The allowed amount of unreliability derived from an SLO, used to balance release velocity against reliability work and trigger corrective action when exhausted.

A rule that evaluates metrics or logs and notifies responders when conditions indicate risk, with thresholds and routing designed to avoid noise.

A documented procedure that tells an operator how to diagnose and resolve a specific alert or recurring operational task, including validation and escalation steps.

The coordinated process of detecting, triaging, containing, eradicating, and learning from service disruptions or security events to restore normal operations.

Collecting logs from many services and accounts into one queryable destination with retention and access controls, simplifying investigation and compliance reporting.

Key-value metadata attached to resources so spending can be grouped by team, application, environment, or owner for reporting and accountability.

A notification triggered when actual or forecast spending crosses a defined threshold for a scope such as a project or label, prompting review before overruns grow.

Showback reports cloud costs to teams for awareness; chargeback actually bills those costs to the responsible budget, driving accountability for consumption decisions.

A pricing commitment where a customer agrees to a minimum usage level or term in exchange for lower rates, trading flexibility for predictable savings.