CCP-C cheat sheet

NIST SP 800-145 defines five essential characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service.

Service models stack responsibility: IaaS (provider handles virtualization through networking), PaaS (provider adds OS, runtime, middleware), SaaS (provider adds the application).

Four deployment models exist: public, private, hybrid, and community cloud.

Shared responsibility: the provider secures the cloud (facilities, hardware, hypervisor); the customer secures what runs in the cloud (data, identities, configuration, patching above the boundary).

Availability percentage to monthly downtime on a 30-day month: 99.9% = ~43.2 min, 99.95% = ~21.6 min, 99.99% = ~4.3 min.

Scale up/down = change the size of one instance; scale out/in = add or remove instances behind a load balancer.

High availability masks failure with redundancy and may allow brief interruption; fault tolerance continues with zero interruption via simultaneously active redundant components.

Region selection is driven by latency to users, data-residency compliance, service availability, and price; multi-region designs improve disaster recovery and reduce latency.

Elasticity matches capacity to demand automatically; scalability is the underlying ability to grow, which may be manual.

CIA triad: confidentiality (no unauthorized disclosure), integrity (no unauthorized modification), availability (timely access).

Least privilege: grant only the permissions required for the task, for the shortest duration, and prefer temporary role credentials over long-lived access keys.

Envelope encryption: a data key encrypts the data; a master key in the key management service encrypts the data key; the wrapped data key is stored with the ciphertext.

Encryption at rest commonly uses AES-256; encryption in transit uses TLS 1.2 or later.

Stateful controls (security groups) remember connection state and auto-allow return traffic; stateless controls (network ACLs) need explicit inbound and outbound rules.

Common attestations to request from a provider: SOC 2 Type II, ISO/IEC 27001, PCI DSS, HIPAA BAA, and GDPR data processing terms.

The compliance boundary moves with the service model: the customer patches the guest OS in IaaS but not in SaaS.

Defense in depth layers identity, network, endpoint, application, and data controls so a single control failure does not expose the asset.

Data classification (public, internal, confidential, restricted) determines the encryption, access, and retention controls applied.

Provisioning creates infrastructure resources; configuration management sets software and settings on resources that already exist.

Blue/green swaps traffic between two identical environments; rollback is a traffic switch back to the previous environment.

Canary releases send a small percentage of traffic to the new version first, compare error and latency metrics to baseline, then expand or abort.

Rolling deployments replace instances in batches, keeping capacity available but running mixed versions during the rollout.

RPO = maximum tolerable data loss measured in time; RTO = maximum tolerable downtime. Both set backup frequency and recovery architecture.

Immutable infrastructure replaces servers with newly built images rather than patching in place, eliminating configuration drift.

MTTR is mean time to repair; MTBF is mean time between failures. Lower MTTR and higher MTBF both raise availability.

Autoscaling policies: target tracking holds a metric at a target value; step scaling adds capacity in tiers based on alarm magnitude.

A tested restore, not the backup job's success message, is the only proof that recovery meets RTO.

IPv4 CIDR host counts: /24 = 256 addresses, /25 = 128, /26 = 64, /27 = 32, /28 = 16; usable hosts are reduced by reserved network and broadcast addresses.

Public subnets route to an internet gateway; private subnets reach the internet outbound through a NAT gateway and accept no unsolicited inbound connections.

Security groups are stateful and instance-level; network ACLs are stateless and subnet-level, evaluated in numbered order with an implicit deny.

Layer 4 load balancers route on IP and port for throughput; layer 7 balancers inspect HTTP host, path, and headers for content-based routing and TLS termination.

Site-to-site VPN runs encrypted tunnels over the public internet with variable latency; a dedicated private circuit gives consistent latency and bandwidth at higher cost and longer lead time.

A CDN caches content at edge locations near users, cutting latency and origin load; cache TTL and invalidation rules govern freshness.

Common ports: 22 SSH, 3389 RDP, 80 HTTP, 443 HTTPS, 3306 MySQL, 5432 PostgreSQL.

VPC peering connects two networks directly and is non-transitive; a transit gateway or hub-and-spoke design is required to route many networks together.

DNS record types: A maps a name to IPv4, AAAA to IPv6, CNAME aliases one name to another, MX directs mail, and TTL controls resolver caching duration.

Block storage presents raw volumes to a single host; file storage presents shared hierarchical directories (NFS/SMB); object storage stores immutable blobs with metadata addressed by key over HTTP.

Durability is the probability data is not lost over time; availability is the fraction of time the service is reachable. Object stores are typically far more durable than they are available.

Storage tiers trade retrieval latency and cost: hot, infrequent access, cold, and archive, with retrieval fees and minimum-duration charges in colder tiers.

Lifecycle policies automatically transition objects between tiers and expire them based on age, reducing cost as access frequency declines.

RAID 0 stripes with no redundancy; RAID 1 mirrors; RAID 5 tolerates one disk failure with distributed parity; RAID 6 tolerates two with dual parity; RAID 10 mirrors then stripes.

3-2-1 backup rule: three copies of data, on two different media types, with one copy offsite.

Synchronous replication acknowledges a write only after the replica confirms (near-zero data loss, higher latency); asynchronous replication acknowledges locally first (lower latency, possible loss up to the RPO).

Strong consistency guarantees every read sees the latest write; eventual consistency allows stale reads for a period in exchange for lower latency and higher availability.

A data lake holds raw schema-on-read files; a data warehouse holds modeled schema-on-write tables optimized for SQL analytics.

Declarative IaC (Terraform, CloudFormation) states the desired end state and the tool computes actions; imperative approaches (scripts, some Ansible tasks) execute explicit ordered commands.

Idempotency means running the same automation twice produces the same end state without duplicating resources; it is the core requirement for safe re-runs.

Terraform keeps a state file mapping declared resources to real resource IDs; it must be stored remotely with locking and access control to prevent concurrent corruption.

Drift detection compares live resource configuration against the declared template and flags divergence caused by manual changes.

CI builds and tests every commit on a shared branch; CD automatically promotes artifacts that pass gates into staging and production.

Deployment strategies in pipelines: rolling (batched replacement), blue/green (parallel environment swap), and canary (percentage traffic ramp).

Observability rests on logs (discrete events), metrics (numeric time series), and traces (request paths across services).

Secrets belong in a managed secret store injected at runtime, never committed to source control or baked into images.

Test pyramid: many fast unit tests, fewer integration tests, and a small number of end-to-end tests to keep feedback loops short.

Cloud converts capital expenditure (upfront assets, depreciated) into operating expenditure (pay-as-you-go consumption).

TCO includes compute, storage, network egress, software licenses, facilities, labor, and downtime risk, not just the hourly instance price.

Purchasing options: on-demand (no commitment), reserved or committed-use (discount for a 1- or 3-year term on steady load), spot (deepest discount, interruptible).

Right-sizing matches instance family and size to measured utilization; over-provisioned instances are the most common source of waste.

Tagging by cost center, project, environment, and owner enables cost allocation; untagged resources cannot be charged back.

Budgets and alerts notify on forecast or actual spend thresholds; they do not cap spending by themselves.

Showback reports costs to teams without moving money; chargeback actually bills the team budget.

Network egress is frequently billed while ingress is free; cross-region and internet data transfer dominate unexpected bills.

Guardrails via policy as code and organizational policy constraints prevent costly or non-compliant resource types before deployment.