IBM Cloud Professional Architect v6 key terms

A logically isolated network within IBM Cloud where you define subnets, IP ranges, routing, and security boundaries for resources such as virtual server instances and Kubernetes workers.

A range of IP addresses carved out of a VPC address prefix, bound to a single zone, that hosts resources and carries its own routing and access control associations.

A stateful virtual firewall attached to network interfaces that permits or denies inbound and outbound traffic by protocol, port, and source or destination address.

A stateless, subnet-level traffic filter evaluated in ordered rules for both directions, sitting alongside security groups as a second layer of network control.

A hub that connects multiple VPCs, classic infrastructure networks, and on-premises links through a single routing point, simplifying peering meshes and centralized connectivity.

A direct private network connection between two VPCs that lets resources communicate using private IP addresses without traversing the public internet or requiring a gateway appliance.

A dedicated private connectivity service between an on-premises or colocation environment and IBM Cloud, offering predictable latency and bandwidth compared with internet-based tunnels.

A geographic area containing one or more data centers (zones) where cloud services are deployed, chosen for latency, data residency, and service availability considerations.

An isolated fault domain inside a region, typically a distinct data center with independent power and cooling, used to spread workloads for resilience.

An architecture pattern that distributes workload instances across independent zones in a region so a single zone failure does not cause an outage.

The design property that keeps a system operating within agreed uptime targets despite component failure, usually achieved through redundancy, health checks, and automatic failover.

The set of plans and technical mechanisms that restore workloads after a major outage, characterized by recovery time and recovery point objectives and by strategies such as backup/restore, pilot light, or active-active.

Recovery Time Objective is the acceptable duration to restore service after disruption; Recovery Point Objective is the acceptable amount of data loss measured in time.

A managed Kubernetes offering where IBM operates the control plane and the customer manages worker nodes and workloads, integrated with VPC networking, registries, and observability services.

A managed OpenShift service providing Kubernetes plus developer and operational tooling such as built-in CI/CD, routes, and security context constraints, with IBM-managed control plane and optional managed worker nodes.

The smallest deployable Kubernetes unit, consisting of one or more containers that share network namespace and storage volumes and are scheduled together on a node.

A private image repository service used to store, scan, and distribute container images that clusters pull when deploying workloads, with namespace-based access control.

A serverless platform that runs container images or source code as event-driven or HTTP-triggered workloads, scaling to zero and removing cluster and infrastructure management from the developer.

A consumption model in which the provider manages servers and scaling, and the customer pays only for resources consumed during execution rather than for idle capacity.

Policy-driven adjustment of compute capacity based on metrics such as CPU utilization or request rate, adding or removing instances to match demand while controlling cost.

A Kubernetes controller that changes the number of pod replicas for a workload in response to observed metrics like CPU or custom indicators.

A virtual machine provisioned in a VPC from an IBM Cloud image or custom image, with selectable profiles defining vCPU and memory and attachable block storage volumes.

A named combination of virtual CPU, memory, and sometimes network performance that determines the capacity and pricing tier of a virtual server instance.

Network-attached persistent volumes that can be attached to virtual server instances, offered in tiers with different IOPS and durability characteristics for boot and data disks.

A service storing unstructured data as objects in buckets, accessed via HTTP APIs, with options for resiliency, lifecycle policies, and immutability controls.

IBM's S3-compatible object storage offering with Standard, Vault, Cold Vault, and Flex classes, used for backups, archives, data lakes, and application content.

The framework that authenticates users and service IDs and authorizes actions through policies binding subjects to roles on resources, with scopes such as account, resource group, or specific instance.

A non-human identity used by applications and automation to obtain API tokens and act under IAM policies, decoupled from individual user accounts.

A credential associated with a user or service ID that can be exchanged for a short-lived IAM token used to authenticate IBM Cloud API calls.

A logical container that groups account resources for access control, billing visibility, and lifecycle organization, and a common scope for IAM policy assignment.

The top-level billing and administrative boundary in IBM Cloud that owns users, resource groups, service instances, and the IAM policies governing them.

The state of meeting regulatory, industry, and internal control requirements, evidenced through certifications, audit logs, configuration evidence, and documented control mappings.

The requirement or guarantee that data remains stored and processed within specified geographic boundaries, influencing region selection and service eligibility.

The practice of creating, rotating, and controlling encryption keys in a dedicated service so that access to data can be revoked independently of the data store itself.

A managed service for generating and managing encryption keys used to protect data in IBM Cloud services, supporting bring-your-own-key and rotation policies.

Transforming data with a key so it is unreadable without authorization, applied at rest on storage and in transit over network connections.

A chronological record of control-plane and account activity used for security investigation, change tracking, and compliance evidence, often forwarded to a centralized logging destination.

A scanning capability that inspects container images and deployed containers for known vulnerabilities and configuration risks, producing findings that inform remediation.

The combined practice of collecting metrics, logs, and traces so operators can understand system behavior, detect anomalies, and diagnose failures across distributed components.

Continuous collection and evaluation of health and performance signals against thresholds, generating alerts that trigger operational response.

A recovery strategy that periodically copies data or workloads to a separate location and restores them after loss, typically with the longest recovery time among DR approaches.

An operating model combining on-premises or private infrastructure with public cloud services, connected by private networking and governed by consistent identity and policy.

The process of moving applications and data to a new platform, using strategies such as rehost, replatform, refactor, repurchase, retain, or retire, each with different effort and benefit tradeoffs.

Evolving an application's architecture, delivery, and operations to exploit cloud capabilities such as containers, managed services, and automation, improving agility and resilience.

An architectural style decomposing an application into independently deployable services with bounded responsibilities, communicating over network APIs and scaled separately.

Selecting instance profiles and capacity that match actual workload demand, avoiding over-provisioning waste and under-provisioning performance risk.

The full cost of running a workload, including compute, storage, network, licensing, support, and operational labor, used to compare architecture options.