CCP-C flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

NIST cloud essential characteristics

NIST SP 800-145 lists five: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. These characteristics distinguish cloud computing from traditional hosted infrastructure.

IaaS vs PaaS vs SaaS

In IaaS the provider manages virtualization through networking while the customer manages the operating system upward; PaaS adds a provider-managed OS and runtime; SaaS delivers a complete provider-managed application.

Shared responsibility model

The provider is responsible for security of the cloud, covering facilities, hardware, and hypervisor. The customer is responsible for security in the cloud: data, identities, configuration, and patching above the service boundary.

Horizontal vs vertical scaling

Horizontal scaling adds or removes instances, called scale out and scale in, and is limited mainly by application design. Vertical scaling resizes a single instance and is capped by hardware limits.

High availability versus fault tolerance

High availability uses redundancy to mask failures, allowing brief interruption during failover. Fault tolerance keeps workloads running with no interruption through fully redundant, simultaneously active components.

Principle of least privilege

Grant each identity only the permissions needed for its task, for the minimum time required, and review entitlements regularly. This limits the blast radius if credentials are compromised.

Envelope encryption with KMS

A data key encrypts the data and a master key encrypts the data key; the wrapped data key is stored alongside the ciphertext, so the master key never leaves the key service.

Encryption at rest vs transit

At-rest encryption protects stored data using algorithms such as AES-256. In-transit encryption protects data moving across networks with TLS 1.2 or later, preventing interception and tampering.

Stateful versus stateless firewalls

Stateful security groups remember connection state and automatically allow return traffic. Stateless network ACLs evaluate every packet independently and require explicit inbound and outbound rules.

CIA triad

Confidentiality, integrity, and availability are the three core security objectives: preventing unauthorized disclosure, preventing unauthorized modification, and ensuring timely access to data and systems.

Blue-green deployment

Two identical environments run side by side; traffic switches from blue to green after the new version passes validation, and rollback is achieved by switching traffic back.

RPO versus RTO

Recovery point objective is the maximum acceptable data loss measured in time. Recovery time objective is the maximum acceptable service downtime. Both drive backup frequency and architecture choices.

Immutable infrastructure

Servers are never patched in place; instead a new image is built and deployed to replace the old one. This eliminates configuration drift and makes rollbacks predictable.

Canary release

A new version is exposed to a small percentage of live traffic first. Metrics are compared against the baseline and the rollout either expands gradually or is aborted automatically.

Configuration drift

Configuration drift occurs when live environment settings diverge from the declared source of truth, usually through manual changes. Drift detection compares actual state to desired state and flags differences.

CIDR block notation

An IPv4 CIDR suffix gives the number of network bits: /24 provides 256 addresses, /25 provides 128, /26 provides 64, and /27 provides 32, with usable hosts reduced by reserved addresses.

L4 versus L7 load balancing

Layer 4 balancers route on IP address and port without inspecting payloads, giving high throughput. Layer 7 balancers inspect HTTP headers and paths to support content-based routing and TLS termination.

NAT gateway purpose

A NAT gateway lets instances in private subnets initiate outbound internet traffic while blocking unsolicited inbound connections, because address translation is one-way unless a mapping exists.

Content delivery network caching

A CDN copies content to edge locations close to users, reducing latency and origin load. Cache TTL headers determine how long objects are served before revalidation against the origin.

Site-to-site VPN versus dedicated link

A VPN runs encrypted tunnels over the public internet with variable latency. A dedicated private circuit bypasses the internet, offering consistent latency and bandwidth at higher cost and longer lead time.

Block, file, and object storage

Block storage presents raw volumes to one host; file storage presents shared hierarchical directories over protocols such as NFS; object storage stores immutable blobs with metadata accessed by key over HTTP.

Durability versus availability

Durability is the probability that data is not lost over time, often expressed in nines. Availability is the proportion of time the service is reachable. Object stores typically exceed availability with durability.

RAID 5 versus RAID 6

RAID 5 tolerates one disk failure using distributed parity. RAID 6 tolerates two simultaneous failures with dual parity. Each sacrifices usable capacity equal to one or two drives respectively.

Storage lifecycle policy

Rules that automatically transition objects between hot, infrequent-access, and archive tiers and then expire them, based on object age, reducing cost as access frequency declines over time.

Synchronous versus asynchronous replication

Synchronous replication acknowledges a write only after the replica confirms it, giving near-zero data loss but higher latency. Asynchronous replication confirms locally first, giving lower latency but possible loss up to the RPO.

Declarative versus imperative IaC

Declarative tools such as Terraform and CloudFormation describe the desired end state and compute the required steps. Imperative tools execute explicit ordered commands such as scripts and ad hoc CLI calls.

Infrastructure as code state file

Terraform records managed resource identities in a state file so it can map real resources to configuration, compute diffs, and detect drift. The file must be stored securely and shared with locking.

Continuous integration

Developers merge code frequently into a shared branch where automated builds and tests run on every commit, surfacing integration defects early and keeping the mainline releasable.

Observability three pillars

Logs record discrete events, metrics are numeric time series aggregated over intervals, and traces follow a single request across services. Together they support diagnosis of distributed systems.

Capital versus operating expenditure

Capital expenditure is the upfront purchase of assets depreciated over time. Operating expenditure is pay-as-you-go consumption. Cloud shifts spending from capex toward opex and improves cash-flow flexibility.

Reserved versus spot pricing

Reserved commitments trade a one- or three-year term for a discount on steady workloads. Spot capacity offers the deepest discount but can be reclaimed with short notice, suiting interruptible jobs.

Showback versus chargeback

Showback reports cloud costs to teams without moving money. Chargeback actually bills each team's budget. Both depend on accurate tagging and account or project segmentation.