IBM Cloud Infrastructure and Services
What the exam tests
This domain tests your ability to place IBM Cloud resources correctly for availability and isolation. Expect accounts, resource groups, IAM scope, VPCs, subnets, zones, instance profiles, load balancers, Cloud Object Storage, IBM Cloud Kubernetes Service, Red Hat OpenShift on IBM Cloud, Code Engine, and managed databases.
Core rules
- An IBM Cloud account contains resource groups. Resource groups organize resources and are an IAM policy scope, but they are not a network boundary.
- A VPC is regional; subnets are zonal. Place workloads across at least three zones in a region to tolerate a zone failure.
- VPC virtual server instances use instance profiles for CPU and memory. Instance groups can spread members across zones and support scaling.
- VPC load balancers provide application-layer HTTP/HTTPS or network-layer TCP traffic distribution. Security groups are stateful; network ACLs are stateless.
- IBM Cloud Kubernetes Service and Red Hat OpenShift on IBM Cloud provide managed Kubernetes. Code Engine runs containerized or batch workloads without cluster management.
- Cloud Object Storage is regional and durable; use it for static assets, backups, and logs where appropriate.
- Managed databases require you to check the high-availability plan and backup configuration; do not assume multi-zone resilience by default.
Worked example. A web app needs 99.95% availability in one region. Place subnets in three zones, put an application load balancer in front, spread instance group members across the zones, store static assets in Cloud Object Storage, and keep a warm standby region with replicated data. Reasoning: a zone failure is tolerated inside the region because the load balancer health-checks remove failed members. A region failure needs a separate disaster-recovery design; multi-zone alone does not provide it.
Traps that cost marks
Putting all virtual servers in one zone; treating a resource group as a network or security boundary; mixing Classic Infrastructure and VPC terminology; assuming every managed database is multi-zone by default; ignoring regional service endpoints; designing multi-zone without testing zone-failure capacity.
Key points
- Resource groups organize resources and scope IAM; they are not networks.
- VPCs are regional; subnets are zonal.
- Spread production workloads across three zones.
- Security groups are stateful; ACLs are stateless.
- Verify high-availability and backup options for managed databases.