CCP (WorldatWork Rewards Certifications) key terms

A separate geographic area, such as Frankfurt or Singapore, containing multiple isolated data centers. Resources are deployed into one region, and choosing a region affects latency, available services, pricing, and legal jurisdiction.

One or more physically separate data centers within a region, with independent power, cooling, and networking. Spreading workloads across several zones in a region protects against a single facility failure.

A small point of presence in a city that caches content and terminates connections close to users. It sits outside regions and is used by content delivery and DNS services rather than for running general compute.

The division of duties between the cloud provider and the customer. The provider secures the physical facilities and underlying hardware; the customer secures data, identities, configurations, and, depending on the service type, the operating system and application.

A service model delivering virtual machines, storage, and networks that the customer configures and patches. The customer controls the guest operating system and above, while the provider manages the physical layer.

An execution model where the provider allocates and scales compute automatically and bills per request and execution time. The customer supplies code or configuration and does not manage servers or capacity planning.

A software-emulated computer with its own virtual CPU, memory, disk, and network interface, running on shared physical hardware. The customer chooses the size, installs the operating system, and manages patching.

A predefined combination of virtual CPU, memory, storage, and network capacity offered for virtual machines. Families are tuned for different needs, such as general purpose, compute optimized, memory optimized, or accelerated computing.

A packaged application with its dependencies that shares the host operating system kernel and starts quickly. Containers are portable across environments and are commonly orchestrated by a managed cluster service.

Automated scheduling, scaling, health checking, and networking of containers across a pool of hosts. Managed offerings remove the burden of running the control plane while the customer defines workloads and policies.

A serverless offering where a single function is triggered by events, HTTP requests, or schedules. The platform runs it on demand, scales automatically, and charges for invocations and compute duration.

Automatically adjusting the number of running instances or workers to match demand, using target metrics or schedules. It maintains performance during peaks and reduces cost during quiet periods.

The ability to acquire resources quickly when demand rises and release them when demand falls. Elasticity distinguishes cloud capacity from fixed on-premises hardware and is central to pay-as-you-go cost control.

A service storing data as objects in flat containers, each with a key, metadata, and a globally unique identifier. It scales to huge volumes and suits backups, media, logs, and static website content.

A named container for objects in an object storage service. Its name is usually globally unique, and access policies, versioning, encryption defaults, and lifecycle rules are configured at this level.

A virtual disk attached to a virtual machine, offering low-latency read and write access at the block level. It persists independently of the instance and can be snapshotted for backup.

A point-in-time copy of a storage volume or database, stored durably and used to restore data or create new volumes. Snapshots are typically incremental and can be copied across regions.

A tier that defines durability, availability, retrieval latency, and price for stored objects. Frequently accessed data uses a hot tier, while archives trade retrieval time for lower storage cost.

A rule that automatically transitions objects or volumes between storage tiers or deletes them after a defined age. It prevents unbounded growth of stale data and lowers storage spend without manual work.

A managed database engine using tables, schemas, and SQL with transactional guarantees. The provider handles provisioning, patching, backups, and replication, while the customer designs schemas and queries.

A read-only copy of a database kept current by replication from the primary. It offloads reporting and read-heavy traffic and can often be promoted if the primary fails.

Running a workload or database primary and standby in separate availability zones so a zone failure does not cause an outage. Failover is usually automatic and the standby is not used for reads.

A logically isolated network in the cloud where you define IP address ranges, subnets, route tables, and gateways. It gives control over traffic flow between workloads and to the internet.

A range of IP addresses within a virtual network, placed in one availability zone. Subnets are labeled public or private depending on whether their route table leads to an internet gateway.

A set of rules deciding where network traffic from a subnet or gateway is sent, based on destination address. It determines whether traffic stays internal, goes to the internet, or crosses to another network.

A stateful virtual firewall attached to resources that allows or denies traffic by protocol, port, and source or destination. Return traffic for permitted connections is automatically allowed.

A stateless firewall applied at the subnet boundary that evaluates ordered allow and deny rules for inbound and outbound traffic. Because it is stateless, return traffic must be explicitly permitted.

A globally distributed cache that serves static and dynamic content from edge locations near users. It reduces latency and origin load and often adds TLS termination and basic attack filtering.

The delay between a request and its response, measured in milliseconds. It is influenced by physical distance, network hops, and service design, and is a primary reason to use multiple regions and edge caching.

The system of users, groups, roles, and policies that determines who can perform which actions on which resources. It is the main control plane for authentication and authorization in the cloud.

An identity with attached permission policies that trusted principals can assume temporarily, receiving short-lived credentials. Roles avoid embedding long-lived keys in code and are common for service-to-service access.

The principle of granting only the permissions needed for a task, for only as long as needed. It limits the blast radius of mistakes and compromised credentials and is enforced through scoped policies.

Protecting stored data by encrypting it on disk so that physical access or a leaked volume does not expose plaintext. Keys may be provider-managed or customer-managed in a key management service.

Protecting data moving across networks using protocols such as TLS, so eavesdroppers cannot read or alter it. It applies to client-to-service traffic and to traffic between internal components.

A managed service that creates, stores, rotates, and audits cryptographic keys, integrating with storage and database encryption. It separates key custody from the data it protects and supports customer-controlled key policies.

A recorded, tamper-evident trail of API calls and administrative actions showing who did what, when, and from where. It supports investigations, compliance evidence, and detection of anomalous behavior.

Collecting and viewing metrics, logs, and events to understand the health and performance of workloads. It underpins alerting, capacity decisions, and troubleshooting.

A notification triggered when a metric or log pattern crosses a defined threshold or matches a condition. Good alerts are actionable, routed to the right owner, and paired with a documented response.

A measurable target for reliability or performance, such as 99.9 percent of requests succeeding within 300 milliseconds over a month. It guides engineering priorities and error-budget decisions.

Designing a system so that component failures cause little or no interruption, typically through redundancy, health checks, and automatic failover across zones. It targets uptime rather than data recovery alone.

The plan and mechanisms for restoring service after a major failure, using backups, replicated copies in another region, and defined recovery time and recovery point targets.

Billing based on actual consumption, such as per second of compute, per gigabyte stored, or per request, with no upfront commitment. It suits variable workloads but can cost more per unit than committed plans.

A commitment to use a defined amount of compute or database capacity for one or three years in exchange for a lower unit price. It rewards steady, predictable workloads but reduces flexibility.

Attaching key-value metadata to resources to record owner, environment, cost center, or project. Tags enable cost allocation reports, automated governance, and bulk operational actions.

A notification that fires when spending or forecasted spending for an account, tag, or service exceeds a configured amount. It surfaces overspend early but does not itself stop resource creation.

The practice of attributing cloud spend to teams, projects, or products so that owners see the financial impact of their choices. It relies on consistent tagging and account structure.

A design where components react to events such as file uploads, queue messages, or state changes rather than polling. It decouples producers from consumers and pairs naturally with serverless compute.