CCP (WorldatWork Rewards Certifications) flashcards
CCP · Build recall with a focused review session.
33 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Shared Responsibility Model
- The provider secures facilities, hardware, and the hypervisor; the customer secures data, identities, access configuration, and the workloads it deploys. Division shifts by service model.
- Availability Zone
- A physically separate datacenter group within a region with independent power and networking, connected to sibling zones by low-latency links. Multi-zone deployment survives single-datacenter failure.
- Recovery Time Objective
- The maximum acceptable duration of service interruption after a failure. RTO drives decisions about standby capacity, automation, and failover architecture.
- Recovery Point Objective
- The maximum acceptable amount of data loss measured in time. RPO determines backup frequency and replication lag tolerance.
- Horizontal vs Vertical Scaling
- Horizontal scaling adds more instances to distribute load; vertical scaling resizes a single instance. Horizontal suits stateless distributed workloads; vertical is simpler but capped by machine size.
- Virtual Machine
- A full guest operating system on emulated hardware with persistent local state. Chosen for lift-and-shift migrations, licensed software, and workloads requiring kernel-level control.
- Serverless Function
- Event-triggered code billed per invocation and execution duration, scaling to zero when idle. Subject to execution time limits and cold-start latency, so unsuited to long-running steady workloads.
- Layer 7 Load Balancer
- Routes requests using application-level attributes such as URL path, host header, or cookie, and can terminate TLS. Layer 4 balances instead on IP address and port.
- Autoscaling Target Tracking
- A policy that adjusts instance count to hold a chosen metric, such as average CPU or requests per instance, near a target value. Simpler than manual step thresholds.
- Immutable Deployment
- Replacing running instances with newly built ones rather than patching in place. Rollback becomes redeploying the previous artifact, and configuration drift is eliminated.
- Object Storage
- Flat-namespace storage accessed over HTTP with effectively unlimited capacity, suited to unstructured files, backups, and static assets. Not mountable as a block device.
- Block Storage Volume
- Network-attached storage presented as a raw disk to one compute instance, formatted with a filesystem. Used for databases and boot volumes needing low latency.
- Storage Lifecycle Policy
- Rules that transition objects to colder tiers or delete them based on age, prefix, or tags. Reduces cost without application changes.
- Durability vs Availability
- Durability is the probability stored data is never lost; availability is the fraction of time it can be read. Replication across zones mainly raises availability.
- Snapshot
- A point-in-time copy of a volume. The first snapshot is full; subsequent ones store only changed blocks, and restoring produces a new independent volume.
- CIDR Block
- A notation such as 10.0.0.0/24 describing a network prefix. The suffix fixes network bits; host bits equal 32 minus the suffix for IPv4.
- Public vs Private Subnet
- A public subnet routes to an internet gateway and can host externally reachable resources. A private subnet reaches the internet only outbound, typically through a NAT gateway.
- Security Group
- Stateful, instance-level firewall rules that allow traffic by protocol and port. Return traffic is automatically permitted, and rules are allow-only with no explicit deny.
- Network ACL
- Stateless subnet-level firewall with numbered allow and deny rules evaluated in order. Because it is stateless, return traffic must be explicitly permitted.
- NAT Gateway
- A managed component letting instances in private subnets initiate outbound internet connections while blocking unsolicited inbound traffic.
- Least Privilege
- Granting only the actions required on the specific resources needed, under explicit conditions. Deny by default and periodically remove unused permissions.
- Identity Federation
- Trusting an external identity provider via SAML or OIDC so users sign in with corporate credentials and receive temporary role-based access instead of separate long-lived accounts.
- Envelope Encryption
- A data key encrypts the payload, and a key management service protects that data key. The root key never leaves the service in plaintext.
- Secrets Manager
- A service storing credentials and API keys with access control and automatic rotation, injecting them at runtime so secrets never appear in code or images.
- Audit Trail
- A tamper-evident log of API activity recording who did what, when, and from where. Centralizing it across accounts is a common compliance control.
- SLI SLO and Error Budget
- An SLI is a measured indicator such as success rate; an SLO is its target; the error budget is one minus the SLO and bounds acceptable failure.
- Blue-Green Deployment
- Running two identical environments and switching traffic from blue to green after validation. Rollback is an immediate traffic switch back.
- Canary Release
- Sending a small percentage of traffic to a new version, monitoring error and latency metrics, then progressively expanding or rolling back.
- Infrastructure as Code
- Declarative templates that provision and version infrastructure reproducibly. Remote locked state prevents concurrent modification and enables team collaboration.
- Observability Three Pillars
- Metrics are numeric time series, logs are discrete timestamped events, and traces follow a request across services. Together they support diagnosis of distributed failures.
- Reserved Commitment
- A one- or three-year spend commitment exchanged for discounted rates on steady baseline usage. Wasteful if the committed capacity is not actually consumed.
- Spot Capacity
- Deeply discounted compute that the provider may reclaim with short notice. Suitable only for fault-tolerant, checkpointed, or stateless batch workloads.
- Cost Allocation Tags
- Key-value metadata attached to resources identifying cost center, project, or environment. Enables showback and chargeback; untagged spend cannot be attributed.