Cloud+ flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

NIST cloud essential characteristics

Five traits define cloud computing: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. A model missing any trait is arguably not cloud.

Shared responsibility model

The split of security duties between provider and customer. The provider secures facilities, hardware, and the hypervisor; the customer secures data, identities, and configuration, with the boundary shifting by service model.

Availability zone

An isolated cluster of data centers within a region with independent power, cooling, and networking. Deploying across multiple zones survives a single facility failure without the latency of cross-region traffic.

Horizontal versus vertical scaling

Horizontal scaling adds more instances to share load; vertical scaling adds CPU, memory, or storage to one instance. Horizontal scales further but requires stateless design or shared session state.

Type 1 hypervisor

A virtualization layer running directly on bare metal with no host operating system, such as ESXi, Hyper-V, or KVM. Lower overhead and better performance make it standard for provider infrastructure.

Containers versus virtual machines

Containers share the host kernel and package only the application and its dependencies, so they start in seconds. Virtual machines include a full guest OS, giving stronger isolation with more overhead.

Blue-green deployment

Two identical environments where traffic is switched from the live blue stack to the newly released green stack at once. Rollback is fast because the old stack remains intact.

Canary release

Sending a small percentage of live traffic to a new version before full rollout. If error rate or latency worsens, the release is reverted while most users never see it.

Rolling deployment

Replacing instances in batches while the rest keep serving traffic. It avoids downtime but runs two versions concurrently, so APIs and database schemas must remain backward compatible.

Lift and shift migration

Moving workloads to the cloud with minimal modification, usually as virtual machines. It is the fastest migration path but forgoes elasticity and managed services, so costs and manual patching persist.

Infrastructure as code

Defining servers, networks, and services in version-controlled template files that a tool deploys repeatedly. It makes environments reproducible, reviewable, and recoverable, and it exposes configuration drift.

RPO versus RTO

Recovery point objective is the maximum tolerable data loss expressed in time; recovery time objective is the maximum acceptable downtime. Together they set backup frequency and the standby architecture required.

Full versus incremental backup

A full backup copies all data; an incremental copies only what changed since the last backup of any type. Restoring requires the last full plus every incremental in sequence.

SLI, SLO, and SLA

The indicator is the measured metric, the objective is the internal target for it, and the agreement is the contractual commitment with penalties. Objectives are set stricter than the contract to leave margin.

Metrics, logs, and traces

Metrics are numeric time series, logs are timestamped event records, and traces follow a single request across services. Together they form the three pillars of observability.

Autoscaling policy types

Target tracking holds a chosen metric near a setpoint such as 60 percent CPU; step scaling reacts to threshold breaches; scheduled scaling covers known peaks. Scale out quickly and in slowly to prevent flapping.

Least privilege

Granting each identity only the permissions its task requires, for only as long as needed. It limits the blast radius of leaked credentials and simplifies reviews of effective access.

Encryption at rest

Storing data encrypted on disk so stolen media, snapshots, or backups are unreadable. It only helps if keys are managed separately, since keys stored beside the ciphertext protect nothing.

Key management service

A managed service that generates, stores, rotates, and audits cryptographic keys, keeping them out of application code and configuration. Authorization to use a key is separate from access to the data.

Federated identity

Trust between an external identity provider and a cloud service so users sign in once with existing corporate credentials and receive tokens. Central deprovisioning removes cloud access in one action.

Security group versus NACL

Security groups are stateful, instance-level allow rules; network ACLs are stateless, subnet-level rules that must permit both request and response directions. Layering both provides defense in depth.

Zero trust

A model that authenticates and authorizes every request regardless of network location, assuming the perimeter is already compromised. Identity, device health, and context replace implicit trust from VPN placement.

CI versus CD

Continuous integration builds and tests every commit; continuous delivery keeps every build releasable behind a manual approval; continuous deployment ships to production automatically. All three depend on automated tests.

Immutable infrastructure

Servers are never patched in place. A new image is built, tested, and swapped in, so rollback means redeploying the prior image and configuration drift disappears.

Declarative versus imperative IaC

Declarative tooling states the desired end state and computes the difference, making it idempotent and drift-aware. Imperative scripts list the steps to run and rerun unsafely unless written defensively.

DORA four key metrics

Deployment frequency, lead time for changes, change failure rate, and time to restore service. High performers improve speed and stability together rather than trading one for the other.

Shift-left testing

Moving testing, security scanning, and quality checks earlier in the pipeline, into unit and integration stages, instead of only before release. Defects found earlier cost less and block fewer stages.

Troubleshooting methodology order

Identify the problem and gather information, establish a theory, test it, plan and implement the fix, verify full functionality, then document. Changing one variable at a time keeps the evidence valid.

Latency versus bandwidth

Bandwidth is capacity per second; latency is round-trip delay per packet. A high-bandwidth link with high latency still slows chatty applications that make many small sequential requests.

Traceroute

Sends packets with incrementing time-to-live values so each router along the path replies, revealing per-hop latency. Timeouts mid-path usually mean ICMP filtering, not a broken link.

Isolating DNS from DHCP

A host with a valid IP but failed name resolution points to DNS; a host with an address starting 169.254 points to DHCP failure. This split narrows scope before deeper testing.

Scope isolation test

Determine whether the fault affects one user, one subnet, one tenant, one zone, or everyone. The blast radius points directly to the layer most likely at fault.