HCIE-Cloud key terms

A geographic area containing one or more isolated data centers that host cloud resources; users choose a region to control latency, data residency, and disaster recovery separation.

An isolated fault domain within a region, with independent power and network, so a failure in one zone does not affect others; workloads are spread across zones for resilience.

An architecture that places redundant instances or replicas in separate availability zones so that the loss of one zone leaves the service running with minimal disruption.

A logically isolated network in the cloud where subnets, route tables, and security rules are defined by the tenant, giving private addressing and controlled connectivity to other networks.

A contiguous range of IP addresses inside a virtual private cloud, bound to one availability zone, used to segment workloads into public-facing and private tiers.

A set of rules that decide where traffic leaving a subnet is forwarded, such as to a local network, a gateway, or a peering connection.

A stateful virtual firewall attached to instances that permits or denies inbound and outbound traffic by protocol, port, and source or destination address.

A stateless, subnet-level filter evaluated in ordered rules for both inbound and outbound traffic, providing a coarse additional layer beyond instance-level security groups.

A static public IP address reserved for a tenant that can be remapped between instances or network devices, keeping external endpoints stable during failover or replacement.

A managed service that lets instances in private subnets initiate outbound internet connections while blocking unsolicited inbound traffic from the internet.

A private network connection between two virtual private clouds that routes traffic over the provider backbone without traversing the public internet or requiring gateways.

A virtual machine instance whose CPU, memory, disk, and network capacity are chosen at creation and can be resized, used to host applications on the cloud platform.

A template containing an operating system and optional preinstalled software used to launch instances consistently and to reproduce environments at scale.

Block storage that can be attached to instances, detached, snapshotted, and resized independently of compute lifecycle, supporting data durability and backup strategies.

A point-in-time copy of a volume or disk stored durably, used to restore data, clone volumes, or create images after accidental deletion or corruption.

A flat namespace storage service for unstructured data accessed over HTTP APIs, offering high durability and scale through buckets and objects rather than file hierarchies.

A JSON-style access control document attached to a storage bucket that grants or denies actions to specified principals, complementing identity-based permissions.

A policy that automatically transitions objects to cheaper storage tiers or deletes them after defined ages, controlling long-term cost and retention compliance.

A service that adjusts the number of running instances based on schedules or metrics such as CPU utilization, matching capacity to demand while controlling cost.

A managed traffic distributor that spreads incoming requests across healthy backend instances using algorithms and health checks, improving availability and horizontal scalability.

A periodic probe that tests whether a backend endpoint responds correctly, so the load balancer or scaling group can remove unhealthy targets from rotation.

The framework of users, groups, roles, and policies that determines who may perform which actions on which cloud resources, enabling least-privilege control.

A structured statement listing allowed or denied actions, resources, and conditions, attached to identities or resources to enforce authorization decisions.

A delegated identity that a trusted account or service can assume temporarily to access resources in another account without sharing long-term credentials.

An encrypted tunnel between an on-premises network and a cloud virtual private cloud, extending private addressing across sites over the public internet.

A dedicated private physical link between an enterprise data center and a cloud region, offering predictable latency and bandwidth compared with internet-based tunnels.

A platform where the provider operates the Kubernetes control plane and the tenant manages worker nodes and workloads, simplifying container orchestration at scale.

A group of worker nodes sharing the same flavor and configuration inside a managed Kubernetes cluster, scaled or upgraded together as a unit.

A lightweight, isolated runtime package bundling an application with its dependencies, sharing the host kernel and starting faster than a full virtual machine.

A compute model where code runs on demand in response to events, with the provider handling scaling and servers, and billing based on execution time and invocations.

A rule that invokes a function or workflow when a defined event occurs, such as an object upload, a scheduled timer, or a message arriving in a queue.

A buffered asynchronous communication service that decouples producers from consumers, absorbing traffic spikes and enabling reliable retry and ordering patterns.

A managed database offering that automates provisioning, patching, backup, and failover for relational engines, letting teams focus on schema and query design.

A synchronized copy of a primary database that serves read-only queries, offloading reporting and read-heavy traffic from the primary instance.

A stored copy of data or configuration taken at a defined schedule or on demand, used to recover from deletion, corruption, or a failed change.

The set of plans and replicated resources that restore service after a major failure, measured by recovery time objective and recovery point objective.

A service that collects metrics, logs, and events from cloud resources, raising alarms and triggering automated actions when thresholds are breached.

A key-value label attached to resources for organization, cost allocation, and automation, allowing queries and policies to target groups of resources.

A logical container that groups related cloud resources so they can be managed, permissioned, and billed together across their lifecycle.