IBM Cloud Professional SRE flashcards
IBM Cloud Professional SRE · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Error budget
- The amount of unreliability an SLO permits, equal to 1 minus the SLO target. For a 99.9% monthly SLO it is roughly 43 minutes of full outage.
- Burn rate
- Observed error rate divided by the error budget rate. A burn rate of 1 consumes exactly the budget over the SLO window; higher values exhaust it faster.
- Toil
- Manual, repetitive, automatable operational work that scales with service growth and produces no lasting value. SRE teams cap it and reinvest time in engineering.
- SLI versus SLO versus SLA
- An SLI is a measured indicator such as latency or error ratio; an SLO is an internal target for that indicator; an SLA is an external contract with defined remedies.
- Blameless postmortem
- A structured review after an incident that documents timeline, contributing factors, and owned action items without assigning individual blame, aiming at systemic improvement.
- Four golden signals
- Latency, traffic, errors, and saturation. These four metrics give a compact view of user-facing health for any request-serving system.
- USE method
- For each resource check utilization, saturation, and errors. It suits infrastructure components like CPU, memory, disks, and network interfaces rather than request flows.
- RED method
- For each service measure request rate, error rate, and request duration. It fits microservices and request-driven workloads better than resource-centric methods.
- Distributed trace
- A record of a single request as it crosses services, composed of spans linked by a shared trace identifier propagated through headers such as W3C traceparent.
- Multi-window burn-rate alerting
- Alerting on SLO burn over several lookback windows. Long windows catch slow burns; short windows catch fast outages, together reducing false pages.
- Incident commander role
- The person who coordinates response, decides priorities, and owns communication during an incident, freeing engineers to diagnose and repair without coordination overhead.
- Activity Tracker
- An IBM Cloud service that records account-level API audit events showing who performed which action, when, and from where, exportable for retention and compliance.
- Terraform state locking
- A mechanism that prevents concurrent applies from corrupting shared state. Remote backends provide locking so only one run mutates infrastructure at a time.
- Idempotent automation
- Automation that converges to the same end state when run repeatedly. It checks current state before acting instead of appending or incrementing blindly.
- Immutable infrastructure
- A model where servers and containers are replaced rather than modified in place, removing configuration drift and making rollback a redeploy of a known artifact.
- GitOps reconciliation
- A controller continuously compares live cluster state with manifests committed in Git and applies differences, making the repository the single source of truth.
- IBM Cloud Schematics
- A managed IBM Cloud service that runs Terraform as workspaces, providing plan and apply execution, state storage, and drift detection without self-hosted runners.
- Canary deployment
- A release strategy that routes a small share of traffic to the new version and monitors SLOs before widening exposure, with automated rollback on regression.
- Resource group
- An IBM Cloud construct that groups resources for access control and lifecycle. IAM policies can be scoped to a resource group, and deletion removes contained resources.
- Region versus zone
- A region is an independent geographic area with its own endpoints; a zone is an isolated fault domain within a region. Multi-zone deployment protects against zone failure.
- Security group versus network ACL
- Security groups are stateful and attach to instances; network ACLs are stateless and attach to subnets. Traffic must be permitted by both to reach a target.
- IBM Cloud Transit Gateway
- A service that connects VPCs, classic infrastructure, and Direct Link attachments through a single routing domain instead of pairwise peering connections.
- Direct Link
- A dedicated private network connection between an on-premises location and IBM Cloud, avoiding public internet transit for latency-sensitive or regulated workloads.
- COS storage classes
- IBM Cloud Object Storage tiers such as Standard, Vault, Cold Vault, and Flex trade retrieval cost and latency against storage price and minimum retention periods.
- Little's Law
- Concurrency equals arrival rate multiplied by time in system. Use it to size connection and thread pools from a latency target and expected request rate.
- Soak test
- A long-running load test at expected peak that reveals memory leaks, file descriptor exhaustion, and gradual degradation that short tests cannot surface.
- Tail latency
- Latency at high percentiles such as p95 or p99. It exposes slow outlier requests that averages hide and should anchor user-facing SLOs.
- Horizontal Pod Autoscaler
- A Kubernetes controller that changes replica count based on observed metrics such as CPU or custom signals, complementing cluster autoscaling of worker nodes.
- RPO and RTO
- Recovery point objective is the maximum tolerable data loss measured in time; recovery time objective is the maximum tolerable downtime. Both drive backup and failover design.
- IAM policy anatomy
- A policy binds a subject such as a user or service ID to a role at a scope of account, resource group, or resource. Least privilege narrows both role and scope.
- Envelope encryption
- A pattern where a root key in a hardware security module wraps data keys that encrypt payloads, enabling rotation without re-encrypting all stored data.
- Service ID and API key
- A non-human identity used by automation to call IBM Cloud APIs. Its API key should be rotated on schedule and stored in a secrets manager, never in code.