HCIA-Cloud cheat sheet

NIST service models: IaaS provides virtualized compute/storage/network; PaaS adds runtime and middleware; SaaS delivers finished applications. Control decreases from IaaS to SaaS.

Deployment models: public cloud is provider-owned and multi-tenant; private cloud is dedicated to one organization; hybrid cloud connects both with unified management; community cloud is shared by organizations with common concerns.

Essential characteristics (NIST): on-demand self-service, broad network access, resource pooling, rapid elasticity, measured service.

Virtualization vs. cloud: virtualization abstracts physical resources on one host; cloud adds self-service, pooling, elasticity and metering across many hosts.

Scalability is the ability to grow capacity (vertical = bigger instance, horizontal = more instances); elasticity is automatic matching of capacity to demand.

Huawei Cloud region/availability zone model: a region is a geographic area; AZs within a region are isolated power and network domains connected by low-latency links. Deploy across AZs for high availability.

CAP theorem: a distributed system cannot simultaneously guarantee consistency, availability and partition tolerance; most cloud databases choose AP or CP trade-offs.

SLA and availability: 99.9% allows about 8.76 hours downtime per year; 99.99% allows about 52.6 minutes; 99.999% allows about 5.26 minutes.

Cloud value: convert CAPEX to OPEX, shorten provisioning time from weeks to minutes, and pay only for resources consumed.

ECS (Elastic Cloud Server): choose flavor family by workload - general purpose (s), memory-optimized (m), compute-optimized (c), GPU/accelerated (g/p); attach EVS volumes and bind EIP for public access.

EVS volume types: common I/O, high I/O, ultra-high I/O and SSD; choose by IOPS and throughput. Snapshots back up EVS; backups use CBR (Cloud Backup and Recovery).

OBS (Object Storage Service): bucket-based, unlimited capacity, accessed by REST API/SDK; storage classes include Standard, Infrequent Access, Archive and Deep Archive; lifecycle rules transition objects between classes.

VPC (Virtual Private Cloud): define subnets, route tables, security groups and ACLs; connect to on-premises with VPN or Direct Connect; peer VPCs with VPC Peering.

ELB (Elastic Load Balance): distributes traffic across backend servers; types include dedicated and shared load balancers; health checks remove unhealthy backends.

AS (Auto Scaling): scales ECS instances by scheduled, periodic or alarm-triggered policies; works with ELB to add/remove backends automatically.

RDS: managed relational database for MySQL, PostgreSQL and SQL Server; supports primary/standby HA, read replicas, automated backups and point-in-time recovery.

CCE (Cloud Container Engine): managed Kubernetes; nodes are worker ECS instances, pods are the smallest deployable units, services expose pods, and node pools group nodes by flavor.

Deployment decision: single ECS for dev/test; ELB + AS for variable web traffic; multi-AZ RDS or DCS for HA databases; OBS for static content and backups.

Compute virtualization: a hypervisor (Type 1 bare-metal, Type 2 hosted) runs VMs; each VM has virtual CPU, memory, disk and NIC; the host schedules physical resources.

CPU virtualization: full virtualization traps privileged instructions; paravirtualization lets the guest call the hypervisor directly; hardware-assisted virtualization (Intel VT-x, AMD-V) reduces overhead.

Memory virtualization: the hypervisor maps guest physical addresses to machine addresses via shadow page tables or hardware EPT/NPT; overcommitment relies on ballooning and swapping.

Storage: block storage (EVS) is attached to one server and formatted with a file system; file storage (SFS) is shared over NFS/CIFS; object storage (OBS) uses flat buckets and HTTP APIs.

RAID: RAID 0 stripes for performance with no redundancy; RAID 1 mirrors; RAID 5 stripes with one parity disk (survives one failure); RAID 6 uses two parity disks; RAID 10 mirrors then stripes.

Network: VLAN isolates Layer 2 broadcast domains; VXLAN encapsulates Layer 2 frames in UDP for overlay networks; SDN separates the control plane from the forwarding plane.

TCP three-way handshake: SYN, SYN-ACK, ACK; connection close uses FIN/ACK exchanges. TCP guarantees ordered delivery; UDP is connectionless and lower latency.

DNS resolves names to IP addresses through recursive and authoritative servers; TTL controls caching duration.

Containers share the host kernel and isolate processes with namespaces and cgroups; VMs each run a full guest OS, giving stronger isolation but slower startup.

CES (Cloud Eye Service): collects metrics from ECS, EVS, ELB, RDS and other services; configure alarm rules on metric thresholds and notify via SMN (Simple Message Notification).

CTS (Cloud Trace Service): records API operations on cloud resources for auditing and troubleshooting; traces are retained per configured tracker.

LTS (Log Tank Service): collects and queries logs from hosts and services; use for centralized log analysis and alerting.

Monitoring layers: infrastructure (CPU, memory, disk, network), platform (database connections, queue depth), application (response time, error rate) and business (orders, logins).

Auto Scaling policy types: scheduled (cron), periodic (recurring), and alarm-based (metric threshold); cooldown prevents rapid repeated scaling actions.

Backup strategy: define RPO (acceptable data loss) and RTO (acceptable recovery time); use CBR for ECS/EVS and OBS cross-region replication for object data.

Change management: test in a non-production environment, use templates or IaC, schedule maintenance windows, and keep a rollback plan.

Capacity management: track utilization trends, set thresholds (for example CPU above 70% sustained), and scale before limits are reached.

Incident response order: detect and classify, contain impact, diagnose root cause, restore service, then document and prevent recurrence.

Shared responsibility: the provider secures the cloud infrastructure; the customer secures data, identities, configurations and applications in the cloud.

IAM (Identity and Access Management): users belong to groups; policies grant permissions; roles allow temporary credential delegation; enable MFA for privileged accounts.

Least privilege: grant only the actions and resources required; use predefined policies first, then custom policies scoped to specific resources.

Security groups are stateful instance-level firewalls that allow rules only; network ACLs are stateless subnet-level filters that allow and deny.

Data protection: encrypt at rest with KMS (Key Management Service) or CMK keys, encrypt in transit with TLS/HTTPS, and classify data by sensitivity.

WAF (Web Application Firewall) filters HTTP/HTTPS attacks such as SQL injection and XSS; Anti-DDoS defends against volumetric and application-layer DDoS.

VSS (Vulnerability Scan Service) detects host and web vulnerabilities; HSS (Host Security Service) provides host intrusion detection and baseline hardening.

DEW (Data Encryption Workshop) includes KMS for key management and CSMS for secret management; rotate keys and never hard-code credentials.

Compliance and audit: enable CTS for API audit trails, use OBS bucket policies and ACLs to control object access, and review logs regularly.