HCIA-Cloud Service flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Region and AZ

A region is a geographic area; each region holds multiple isolated AZs linked by low-latency fiber. Deploying across AZs protects workloads from single-AZ failure, while resources in one AZ stay isolated from another.

Shared responsibility model

Huawei Cloud secures physical facilities, the hypervisor, and the network fabric. The customer secures guest OS patching, IAM policies, security group rules, data encryption, and application configuration.

AK/SK credentials

Access key ID identifies the API caller; the secret key signs each request and must never be embedded in client code or shared. Rotate keys regularly and prefer IAM users over the root account.

Pay-per-use versus subscription

Pay-per-use bills by actual usage duration and suits variable workloads. Yearly/monthly subscription commits to a fixed term at a lower unit price and suits stable, long-running production workloads.

Enterprise projects and tags

Enterprise projects group resources for permission and cost management; tags are key-value labels used for cost allocation, search, and automation. Cost center reports break spend down by either.

Bare metal server (BMS)

BMS provides dedicated physical servers without a hypervisor layer, delivering predictable performance and hardware isolation. It suits high-performance databases, HPC, and workloads needing direct hardware access.

ECS flavor families

Flavor families target workload profiles: general-purpose (s), compute-optimized (c), memory-optimized (m), GPU/accelerated (g/p), and disk-intensive (d). Flavor names encode vCPU count and memory size.

Stopped ECS billing

A stopped pay-per-use ECS stops incurring compute charges but continues to incur charges for attached EVS disks and bound EIPs. Delete unneeded disks and release EIPs to avoid ongoing cost.

IMS image types

IMS stores public images provided by Huawei, private images created from ECS or imported, shared images from other accounts, and marketplace images. Images are the template for launching new ECS instances.

Full-ECS image

A full-ECS image captures the OS disk plus all data disks, enabling complete server replication or migration. A system-disk image captures only the OS disk and requires separate data disk handling.

Auto Scaling components

A scaling configuration defines the instance template (image, flavor, network, key pair); a scaling group sets minimum, desired, and maximum counts; a scaling policy triggers changes by alarm, schedule, or period.

AS cooldown period

After a scaling action completes, the cooldown period suppresses further scaling actions. This prevents rapid oscillation when metrics fluctuate, giving new instances time to start and stabilize.

ECS metadata service

The link-local address 169.254.169.254 exposes instance metadata such as instance ID, AZ, and user data. User data scripts supplied at creation run at first boot to automate configuration.

OBS buckets and objects

OBS stores unstructured data as objects inside buckets, accessed over HTTP/HTTPS REST APIs. Buckets are region-scoped and capacity is effectively unlimited, suiting backups, media, and static websites.

OBS storage classes

Standard suits frequent access; Infrequent Access, Archive, and Deep Archive trade retrieval latency and minimum storage duration for lower cost. Lifecycle rules move objects between classes automatically.

Pre-signed URL

A pre-signed URL grants temporary access to a specific OBS object without exposing credentials. It carries a signature and expiry, so recipients can download or upload until the URL expires.

EVS disk types

EVS offers general-purpose SSD, ultra-high I/O, and high I/O disks differing in IOPS and throughput. A disk attaches to one ECS in the same AZ and serves as its system or data disk.

EVS snapshot behavior

EVS snapshots are incremental: only changed blocks are stored after the first snapshot. Snapshots are independent of the source disk and can create new disks or restore data after failure.

EVS resize limits

EVS disks can be enlarged online in most cases, but shrinking is not supported. After enlarging the disk, the partition and file system inside the guest OS must be expanded separately.

SFS shared file storage

SFS provides NFS or CIFS file systems mountable concurrently by multiple ECS instances. SFS Turbo delivers higher throughput and lower latency for performance-sensitive shared workloads.

Storage selection rule

Use EVS block storage for a single server's OS or database disk, SFS for shared directories across servers, and OBS for large-scale unstructured data accessed over HTTP.

VPC and subnets

A VPC is an isolated virtual network defined by a CIDR block; subnets divide it and are AZ-scoped. Resources in different VPCs cannot communicate unless peering, VPN, or another connection is configured.

Security group versus network ACL

Security groups are stateful, instance-level firewalls supporting allow rules only. Network ACLs are stateless, subnet-level firewalls supporting both allow and deny rules for traffic entering or leaving.

Elastic IP address

An EIP is a public IP that can be bound to ECS, ELB, NAT Gateway, or BMS and rebound when needed. Bandwidth is billed either by fixed bandwidth or by actual traffic volume.

NAT Gateway

NAT Gateway lets VPC instances without EIPs initiate outbound internet connections. DNAT rules additionally provide inbound port forwarding to internal servers without exposing them directly.

ELB listener and backend group

A listener defines the protocol and port the load balancer accepts; a backend server group holds the targets. Health checks remove unhealthy backends from rotation until they pass again.

Layer 7 ELB features

HTTP/HTTPS listeners support URL-based routing, host-based routing, and session persistence via cookies. TCP/UDP listeners forward purely by IP address and port at layer 4.

VPC peering and VPN

A peering connection links two VPCs privately without public transit. VPN connects on-premises networks to a VPC over IPsec, while Direct Connect provides a dedicated private physical link.

IAM policy evaluation

IAM policies are JSON documents granting Allow or Deny on actions and resources; an explicit Deny always overrides any Allow. Permissions attach to users or user groups, not directly to resources.

Cloud Trace Service (CTS)

CTS records API-level operations performed on account resources, capturing who did what and when. It supports security auditing, compliance evidence, and troubleshooting of configuration changes.

Cloud Eye (CES)

CES collects metrics from cloud resources and raises alarms when thresholds are crossed. Alarm actions can trigger Auto Scaling policies or send notifications through SMN to operators.

WAF and Anti-DDoS

Anti-DDoS mitigates volumetric network attacks against public IPs. WAF inspects layer 7 HTTP/HTTPS traffic and blocks attacks such as SQL injection and cross-site scripting targeting web applications.