IBM Cloud Professional Architect v6 flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Resource group

A logical container that organizes service instances for access control and billing. Every IBM Cloud service instance belongs to exactly one resource group, fixed at provisioning time.

VPC subnet zone scope

A VPC spans a region, but each subnet exists in exactly one zone. For high availability, create subnets in at least three zones and spread instances across them.

Transit Gateway

A network service that connects VPCs, classic infrastructure, and Direct Link across regions through a single hub, avoiding a full mesh of point-to-point connections.

Multizone cluster

An IKS or OpenShift cluster whose worker nodes are distributed across three zones in a region, so a single zone failure does not take down the application.

Cloud Internet Services

IBM's edge service providing global load balancing, DDoS protection, WAF, and DNS. It is the recommended entry point for public-facing multi-region applications.

Direct Link

A dedicated private connection between an on-premises network and IBM Cloud, bypassing the public internet. It is offered in 1 Gbps, 2 Gbps, 5 Gbps, and 10 Gbps speeds.

Schematics

IBM Cloud's managed Terraform service. It provisions infrastructure as code, detects drift between declared and actual state, and supports repeatable environment creation.

Code Engine

A serverless platform that runs container images and source builds, scales to zero when idle, and bills only for resources consumed during request handling.

Secrets Manager

A service for storing and rotating credentials, API keys, and certificates. Applications retrieve secrets at runtime instead of embedding them in code or configuration.

COS resiliency tiers

IBM Cloud Object Storage offers Cross Region, Regional, and Single Data Center resiliency. Cross Region replicates across geographies; Regional stays within one region; Single Data Center is legacy.

Event Streams

A managed Apache Kafka service on IBM Cloud used for high-throughput event streaming, log aggregation, and decoupled communication between microservices.

Service ID

A non-human identity used by applications and automation. It carries its own API keys and IAM policies and is not tied to a person's employment status.

Rehost migration

Also called lift-and-shift: moving a workload to cloud infrastructure with minimal code change. It is fastest but captures the least cloud-native benefit.

Replatform migration

Moving a workload to cloud while swapping components for managed services, such as replacing a self-managed database with a managed database, without rewriting the application.

Refactor migration

Rewriting or restructuring an application to use cloud-native patterns such as containers, microservices, and managed services. Highest effort and highest long-term agility.

VMware Solutions on IBM Cloud

A dedicated or shared VMware SDDC running on IBM Cloud bare metal. It preserves vSphere and NSX tooling, easing migration of existing virtualized estates.

Migration Advisor

An IBM Cloud tool that assesses on-premises and VMware workloads, estimates cloud sizing and cost, and produces a migration plan before cutover.

Cutover window

The planned period when production traffic moves from source to target. Data replication runs beforehand; DNS or load balancer changes complete the switch.

Access group

An IAM construct that bundles service IDs and users so a single policy grants them all the same access. It simplifies administration and reduces policy sprawl.

Platform vs service roles

Platform roles (Viewer, Editor, Operator, Administrator) control resource lifecycle. Service roles (Reader, Writer, Manager) control access to data inside a service instance.

Hyper Protect Crypto Services

A dedicated HSM offering FIPS 140-2 Level 4 certification with keep-your-own-key capability. It is used where the highest key custody assurance is required.

Key Protect

A managed key management service providing FIPS 140-2 Level 3 root of trust for encrypting data at rest in IBM Cloud services such as COS and Block Storage.

Security group vs ACL

VPC security groups are stateful and attach to network interfaces. Network ACLs are stateless and apply at the subnet level. Use both for layered protection.

Activity Tracker

A service that records account-level API activity for audit and compliance. It captures who did what, when, and from where across IBM Cloud services.

Data residency

The requirement that data remains within a specified jurisdiction. It is satisfied by choosing an appropriate region and avoiding cross-region replication outside that boundary.

RTO

Recovery Time Objective: the maximum acceptable duration of downtime after a failure. It drives choices such as warm standby versus backup-and-restore.

RPO

Recovery Point Objective: the maximum acceptable amount of data loss measured in time. Backup frequency and replication lag determine whether the RPO is met.

Serial availability math

Components in series multiply their availability. Two dependent services at 99.9 percent each yield roughly 99.8 percent combined, so minimize serial dependencies.

Horizontal pod autoscaler

A Kubernetes controller that adds or removes pods based on observed CPU, memory, or custom metrics, keeping performance steady while controlling cost.

Instance group

A VPC feature that maintains a set of identical virtual server instances, automatically replacing failed members and scaling capacity up or down on demand.

Pilot light DR

A disaster recovery pattern keeping a minimal core running in the standby region. It balances lower cost against a longer recovery time than warm standby.

Right-sizing

Matching provisioned capacity to actual demand using utilization data. Consistently low utilization signals downsizing or consolidation to reduce spend.

Reserved capacity

A commitment to a fixed term of usage in exchange for a lower rate. It suits steady-state workloads with predictable, continuous demand.