Cloud+ key terms

Technology that lets one physical server run several isolated operating systems at once by sharing its processor, memory, and storage through a hypervisor. It improves hardware utilization, speeds provisioning, and makes workloads portable across hardware.

The software layer that creates and runs virtual machines and divides physical resources among them. A type 1 hypervisor runs directly on server hardware; a type 2 hypervisor runs as an application on a host operating system.

A logically isolated network inside a public cloud where you define subnets, route tables, and gateways. It controls which resources can communicate with each other and which can reach the internet.

An isolated group of data centers within a cloud region with independent power, cooling, and networking. Spreading workloads across several zones keeps an application running when one zone fails.

A geographic area containing multiple availability zones. Organizations choose regions based on user latency, legal data-residency requirements, which services are offered, and price differences between locations.

An approach that separates the network control plane, which decides where traffic goes, from the data plane that forwards packets. Administrators set routing and policy centrally through software rather than configuring each device.

Storage delivered as raw volumes attached to a server, which the operating system formats with a filesystem and treats like a local disk. It offers low latency and is commonly used for databases.

Storage that keeps data as discrete objects, each with its own key and metadata, in a flat address space reached through HTTP APIs. It scales easily and suits backups, media files, and static web content.

A lightweight package holding an application and its dependencies that shares the host operating system kernel. Containers start in seconds and consume fewer resources than full virtual machines.

Automation that schedules, networks, scales, and restarts containers across a cluster of hosts. Tools such as Kubernetes maintain the declared number of instances and replace failed ones automatically.

An execution model where the provider runs your code on demand and manages every server. You pay only for resources consumed during execution, and the platform scales automatically, including down to zero.

A deployment model that combines private infrastructure or a private cloud with public cloud services, with some orchestration between them. It is often chosen for data residency, legacy systems, or gradual migration.

A migration strategy that moves applications to the cloud with little or no modification, usually rehosting servers as they are. It is fast and low risk but forfeits most cloud-native benefits.

An encrypted tunnel connecting an on-premises network to a cloud network across the public internet. It provides hybrid connectivity without the cost or lead time of a dedicated private circuit.

The automatic adjustment of compute capacity to match demand. The platform adds instances when metrics such as CPU utilization rise and removes them when load falls, balancing cost against performance.

Distributing incoming requests across multiple servers so no single instance is overwhelmed. Health checks remove failing targets from rotation, which improves availability and keeps response times steady.

A contract stating the availability, performance, and support levels a provider promises, plus remedies such as service credits when targets are missed. Customers use it to judge whether a service meets requirements.

The maximum acceptable downtime after a disruption, expressed as a duration. It drives design choices such as backup restore, warm standby, or active-active, and should be agreed before an outage happens.

The maximum acceptable amount of data loss measured in time. An RPO of one hour means backups or replication must happen at least that often to satisfy the business requirement.

A controlled process for requesting, reviewing, approving, and documenting modifications to production systems. It reduces outages caused by untested or unrecorded changes and leaves an audit trail.

The split of security duties between a cloud provider and its customer. The provider secures facilities, hardware, and the hypervisor; the customer secures data, identities, access policies, and the configuration of what it deploys.

The framework of users, groups, roles, and policies that determines who can sign in to a cloud environment and which actions each identity may perform on which resources.

A security principle giving each user, service, or process only the permissions needed to do its job, nothing more. It limits the damage possible when credentials are stolen or a component is compromised.

Requiring two or more independent proofs of identity at sign-in, such as a password plus a code from an authenticator app. A stolen password alone then cannot grant access.

Encoding stored data with cryptographic keys so stolen disks, leaked snapshots, or copied backups cannot be read. Key custody and rotation matter as much as the encryption algorithm itself.

A central service for generating, storing, rotating, and auditing encryption keys. It keeps key material out of application code and separates control of keys from the storage holding encrypted data.

A stateful virtual firewall attached to individual cloud resources that allows or denies traffic by port, protocol, and source. Rules usually default to denying inbound traffic and are evaluated together.

Defining servers, networks, and other resources in machine-readable template or configuration files instead of clicking through a console. Environments become repeatable, version-controlled, reviewable, and easy to rebuild.

An automated sequence that builds, tests, and releases code changes. Continuous integration validates frequent merges; continuous delivery or deployment moves approved artifacts into staging and production reliably.

A model in which running servers are never patched or modified in place. Replacements are built from a new image and swapped in, which removes configuration drift and makes rollback predictable.

An architectural style splitting an application into small, independently deployable services that communicate over APIs. Teams can release and scale each service separately, at the cost of more operational complexity.

A release technique that runs two identical environments and switches traffic from the live blue environment to the updated green one. If the new version fails, traffic returns to blue almost instantly.

Sending a change to a small portion of users or traffic first, watching error rates and latency, then expanding the rollout or reverting before most users are affected.

The ability to infer a system's internal state from the metrics, logs, and traces it emits, so operators can diagnose problems they never anticipated rather than only those they predicted.

Collecting log events from many servers and services into one searchable store. Central collection lets engineers correlate events across components and retain records for audits and incident review.

A structured method of tracing a failure past its symptoms to the underlying origin, often using techniques such as the five whys or fault-tree analysis, so the fix prevents recurrence.

The process for detecting, triaging, escalating, resolving, and reviewing service disruptions. Good practice restores service quickly, keeps stakeholders informed, and captures lessons afterward.

The gradual divergence of a system's real settings from its documented baseline, usually caused by manual changes or missed automation. It makes supposedly identical servers behave differently and complicates troubleshooting.