Exoscale Certified Cloud Professional flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Instance family naming

Exoscale instance types combine a family (Standard, CPU, Memory, Storage, GPU) with a size number that indicates vCPU count; the family determines the RAM-to-vCPU ratio and intended workload.

Anti-affinity group

A placement constraint that prevents instances in the same group from running on the same physical hypervisor, improving availability for clustered workloads.

Cloud-init user data

A script or configuration supplied at instance creation and executed on first boot; used to bootstrap packages, users, and configuration. Size is limited (typically 32 KiB base64-encoded).

Elastic IP

A static public IPv4 address that can be reserved and attached to an instance in the same zone, remaining stable across instance stop/start and re-attachment.

Instance metadata service

An internal endpoint at 169.254.169.254 that returns instance identity, zone, and user data to the guest; can be protected with a metadata token to reduce SSRF risk.

Block storage volume

A network-attached SSD-backed disk that attaches to one instance at a time in a zone; can be grown online and snapshotted, but not shrunk.

Volume snapshot

A point-in-time copy of a block storage volume stored in the same zone; used to create new volumes or restore data after corruption or accidental deletion.

SOS bucket policy

A JSON policy attached to an object storage bucket that grants or denies actions (e.g., s3:GetObject) to principals, complementing or replacing per-object ACLs.

Pre-signed URL

A time-limited URL generated with credentials that grants temporary access to a specific SOS object without exposing the underlying API keys.

Multipart upload

An S3-compatible mechanism that splits large objects into parts uploaded in parallel and assembled server-side; required above the single-PUT size limit (typically 5 GiB).

DBaaS service URI

A connection string returned at provisioning that contains host, port, database name, and credentials; TLS is enforced and the CA certificate must be downloaded separately.

Point-in-time recovery

A DBaaS capability that restores a database to a specific timestamp within the backup retention window (typically up to 30 days) using continuous WAL/binlog archiving.

DBaaS IP filter

An allowlist of source CIDR ranges permitted to connect to a managed database service; used to restrict public access when the service is not on a private network.

DBaaS HA plan

A managed database plan that runs multiple nodes across availability zones within a zone group, providing automatic failover and higher availability than a single-node plan.

Valkey on Exoscale

A managed Redis-compatible in-memory data store offered as DBaaS, used for caching, queues, and session storage; provisioned per zone with TLS and IP filtering.

Zone-scoped private network

An isolated L2 network that exists within a single Exoscale zone; instances attached to it communicate privately, and it cannot span zones.

Stateful security group

A virtual firewall applied to an instance NIC that tracks connections, automatically allowing return traffic for permitted outbound or inbound flows; default deny inbound.

L7 load balancer

An Exoscale load balancer that terminates HTTP/HTTPS, supports TLS certificates, and routes requests to backend services on a private network using health checks.

Private Connect

A dedicated interconnect that links an Exoscale private network to an external network such as on-premises or another cloud, enabling private hybrid connectivity.

Egress billing

Exoscale charges for data transferred from a zone to the public internet per GiB; ingress and intra-zone private traffic are not billed.

IAM API key

A credential pair (key and secret) used to authenticate API calls; permissions are constrained by attached IAM policies that scope allowed operations and resources.

Instance IAM role

A role assumed by a compute instance through the metadata service, issuing short-lived credentials so applications avoid storing long-lived API secrets on disk.

Security group union model

Exoscale security groups are allow-only; effective rules are the union of all groups attached to an instance, and there is no explicit deny rule.

TLS termination

Offloading TLS decryption to a load balancer using an uploaded certificate, so backend instances receive plain HTTP while clients use HTTPS.

Audit log

A record of API and portal actions in an Exoscale account, used for security investigation and compliance evidence; should be forwarded to a SIEM for retention.

Concrete AI GPU instances

Exoscale compute instances with NVIDIA GPUs and pre-installed drivers/CUDA, available in selected zones and billed per minute while running.

GPU cost control

Stopping a GPU instance halts compute billing while attached disk continues to bill; snapshots preserve state so instances can be recreated later.

AI dataset storage

SOS object storage is used for datasets and model artifacts; access via IAM roles or pre-signed URLs avoids embedding credentials in training code.

Shared responsibility model

Exoscale secures physical infrastructure, hypervisor, and managed control planes; customers secure guest OS, applications, identities, and data.

Trust center

Exoscale's public portal listing certifications, subprocessors, DPAs, and security documentation; the authoritative source for compliance evidence requests.

Subprocessor list

A published inventory of third parties that process customer data on Exoscale's behalf; changes are notified per the DPA so customers can assess impact.

Zone-based data residency

Physical data location is determined by the zone chosen at provisioning (e.g., CH-GVA-2 in Switzerland, DE-FRA-1 in Germany); all resources must be placed accordingly.