CCP (WorldatWork Rewards Certifications) cheat sheet

Shared responsibility: the provider secures the physical layer (facilities, hardware, hypervisor); the customer secures data, identity, and configuration of consumed services.

Service models shift control: IaaS leaves OS and runtime to the customer; PaaS leaves only application and data; SaaS leaves only data and access configuration.

Regions contain multiple isolated Availability Zones; AZs are physically separate within a region and connect over low-latency links, while edge locations cache content closer to users.

Availability design: multi-AZ addresses datacenter failure; multi-region addresses regional failure; the recovery objective determines which is required.

RTO is the maximum tolerable downtime; RPO is the maximum tolerable data loss. Backup frequency is driven by RPO, failover automation by RTO.

Elasticity scales resources with demand automatically; scalability is the capacity to grow. Vertical scaling resizes one instance; horizontal scaling adds instances.

Well-architected pillars: operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability.

Cloud-native architecture favors loosely coupled, stateless, horizontally scalable components with managed services absorbing undifferentiated operational work.

Virtual machines give full OS control and persistent state; choose them for lift-and-shift, licensed software, and workloads needing kernel-level tuning.

Containers package application and dependencies on a shared kernel; they start faster than VMs and suit microservices with consistent build artifacts.

Serverless functions scale to zero and bill per invocation and duration; they impose execution time limits and cold-start latency, so avoid them for long-running or latency-critical steady load.

Managed container orchestration handles scheduling, self-healing, and rolling updates; the control plane is provider-operated while nodes and workloads remain customer-configured.

Autoscaling policies use target-tracking metrics (CPU, requests per instance), scheduled actions for known peaks, and step scaling for bursty thresholds.

Load balancers: layer 4 routes on IP and port with high throughput; layer 7 routes on path and host, supports TLS termination, and enables content-based rules.

Batch and job services suit non-interactive, finite work; queue-driven worker pools decouple intake from processing and absorb spikes without over-provisioning.

Immutable deployment replaces instances rather than patching in place, so rollback is a redeploy of the prior artifact and drift is eliminated.

Object storage is flat-namespaced, HTTP-accessed, effectively unlimited, and ideal for unstructured data; block storage attaches to a single compute instance as a volume.

File storage offers shared hierarchical access over a network protocol for many concurrent clients; use it when multiple nodes must read the same files.

Storage tiers trade retrieval latency and cost: hot for frequent access, infrequent-access and archive tiers for cold data, with minimum-duration charges and retrieval fees on cold tiers.

Durability is the probability data is not lost; availability is the fraction of time it is readable. Replication across zones raises availability; replication raises durability.

Lifecycle policies transition or expire objects by age, prefix, or tag; they control cost without application changes.

Snapshots are incremental point-in-time copies; the first is full, later ones store only changed blocks, and restoring creates a new volume.

Relational databases enforce schema and ACID transactions and suit joins and integrity constraints; key-value and document stores trade transactions for horizontal scale and flexible schemas.

Caching layers (in-memory stores, read replicas, CDN) reduce read latency and primary load; cache invalidation strategy determines staleness risk.

CIDR notation /n fixes the network prefix; host bits = 32 - n for IPv4. A /24 has 256 addresses; cloud subnets typically reserve a few for the provider.

A VPC is an isolated virtual network with its own address range, subnets, route tables, and gateways; subnets map to a single Availability Zone.

Public subnets route to an internet gateway; private subnets reach the internet through a NAT gateway for outbound-only traffic.

Security groups are stateful instance-level allow rules; network ACLs are stateless subnet-level allow and deny rules evaluated in order.

Route tables select the next hop per destination prefix; the most specific matching route wins.

Site-to-site VPN runs encrypted tunnels over the public internet; dedicated private circuits offer predictable latency and bandwidth at higher cost and longer lead time.

DNS routing policies include simple, weighted, latency-based, failover, and geolocation; health checks drive failover records.

CDNs and edge caches terminate TLS near users, reduce origin load, and cut latency; cache TTL and invalidation govern freshness.

Least privilege: grant the minimum actions on the minimum resources under explicit conditions; deny by default and review unused permissions periodically.

Federation via SAML or OIDC lets users authenticate to the provider with existing corporate credentials; temporary role credentials replace long-lived access keys.

Envelope encryption: a data key encrypts data, and a key-management service protects the data key; the master key never leaves the service in plaintext.

Encryption at rest protects stored volumes and objects; encryption in transit uses TLS. Key rotation limits exposure from a compromised key.

Secrets managers store and rotate credentials and inject them at runtime, avoiding secrets in code, images, or environment files.

Defense in depth layers identity, network, application, and data controls so a single failed control does not expose the workload.

Audit logging records API activity to an immutable trail; configuring it centrally across accounts is a common compliance requirement.

Compliance frameworks (SOC 2, ISO 27001, HIPAA, PCI DSS) map to provider attestations for the provider's scope; the customer remains responsible for its own controls.

The three pillars of observability: metrics are numeric time series, logs are discrete events, and traces follow a request across services.

SLI is a measured indicator; SLO is the target for that indicator; the error budget is 1 minus the SLO and governs release velocity.

Alert on symptoms users feel (latency, error rate, saturation) rather than every underlying cause to avoid alert fatigue.

Infrastructure as code makes environments reproducible and reviewable; state files must be locked and stored remotely to prevent concurrent modification.

Deployment strategies: rolling replaces instances gradually; blue-green swaps two environments for instant rollback; canary sends a small traffic slice first.

Backups require periodic restore testing; an untested backup is an assumption, not a recovery capability.

Runbooks document detection, diagnosis, and remediation steps; post-incident reviews focus on systemic causes rather than individual blame.

Health checks remove unhealthy targets from load balancer rotation; deep health checks validate dependencies, shallow ones only process liveness.

Pay-as-you-go converts capital expense to operating expense; reserved commitments and savings plans discount steady baseline usage in exchange for term and spend commitment.

Spot or preemptible capacity is deeply discounted but interruptible; use it for fault-tolerant batch and stateless workers only.

Total cost of ownership includes compute, storage, egress, licensing, and staff time; comparing list price alone understates operational cost.

Data transfer out to the internet and cross-region traffic are billed; same-zone traffic is typically free or cheapest.

Idle and oversized resources are the largest avoidable cost: rightsize instances, delete unattached volumes and old snapshots, and schedule non-production shutdowns.

Tagging by cost center, project, and environment enables chargeback and showback; untagged spend cannot be attributed.

Budgets and anomaly detection alert on actual or forecast thresholds; they detect overspend but do not prevent it unless paired with policy limits.

Governance guardrails: organizational units, service control policies, and quota limits constrain what accounts may deploy before resources are created.