CCOA (IJCAHPO) flashcards
CCOA · Build recall with a focused review session.
33 cards. Read the term and the definition here. The deck at the top of this page is optional.
- RPO vs RTO
- Recovery Point Objective is the maximum tolerable data loss measured in time; Recovery Time Objective is the maximum tolerable downtime. Backup frequency drives RPO, failover automation drives RTO.
- Pilot light vs warm standby
- Pilot light keeps data replicated and a minimal core running, scaling up on failover. Warm standby keeps a scaled-down but fully functional copy of the stack ready to take traffic.
- Availability of parallel paths
- For n independent redundant paths each with availability A, combined availability is 1 minus (1 minus A) to the n. Two independent 99% paths give 99.99%.
- Shared responsibility model
- The provider secures physical facilities, hardware, and managed-service internals; the customer secures identity, data, configuration, network policy, and patching of self-managed components.
- Idempotent automation
- An operation is idempotent when running it repeatedly produces the same end state and no duplicate side effects, making retries and re-runs after partial failure safe.
- Dead-letter queue
- A holding queue for messages that exhausted retry attempts, isolating poison messages so they can be inspected and replayed without blocking the main processing flow.
- Saga compensation
- A distributed transaction pattern where each step has a compensating action; on failure, compensations run in reverse order to undo completed steps.
- Exponential backoff with jitter
- Retry delay grows exponentially per attempt, with random jitter added so many clients do not retry simultaneously; attempts are capped and then routed to a dead-letter queue.
- Terraform state locking
- A remote backend plus lock mechanism prevents two concurrent applies from writing the same state file, which would otherwise corrupt the mapping between declared and real resources.
- Immutable infrastructure
- Servers and containers are built as versioned images and replaced rather than patched in place, eliminating configuration drift and making rollback a redeploy of a known image.
- Drift detection
- Running a plan or diff on a schedule against unchanged code; any non-empty diff indicates an out-of-band manual change to real infrastructure that must be reconciled.
- Module version pinning
- Referencing infrastructure modules and providers by exact version rather than latest, so builds are reproducible and an upstream release cannot silently break a pipeline.
- Kubernetes requests vs limits
- Requests are used by the scheduler to place pods; limits are enforced by cgroups. Exceeding a CPU limit throttles, exceeding a memory limit triggers OOM kill.
- Liveness vs readiness probe
- A failing liveness probe restarts the container; a failing readiness probe removes the pod from Service endpoints without restarting it. A startup probe covers slow boot.
- StatefulSet vs Deployment
- Deployments manage interchangeable stateless pods with rolling updates. StatefulSets give stable pod names, ordered rollout, and per-pod persistent volume claims.
- Pod QoS classes
- Guaranteed means requests equal limits on all containers; Burstable means some are set; BestEffort means none. Under node pressure, BestEffort pods are evicted first.
- HorizontalPodAutoscaler
- A controller that adjusts replica count based on observed metrics such as CPU or custom queue depth, working with the Cluster Autoscaler which adds nodes for pending pods.
- Blue/green deployment
- Two full environments run side by side; traffic is switched from blue to green at once, giving instant rollback by switching back if health checks fail.
- Canary release
- A small percentage of traffic is routed to the new version first, and rollout proceeds only if error rate and latency metrics stay within threshold; otherwise it auto-rolls back.
- Deploy versus release
- Deploying ships code to production inert; releasing exposes it to users. Feature flags separate the two so rollback is a flag change, not a redeploy.
- Expand/contract migration
- A backward-compatible database change sequence: add new columns first, dual-write, migrate readers, then remove old columns, so old and new app versions coexist during rollout.
- DORA four keys
- Deployment frequency, lead time for changes, change-failure rate, and time to restore service are the four delivery metrics used to gauge software delivery performance.
- SLI, SLO, and error budget
- An SLI is a measured indicator such as success rate; an SLO is its target over a window; the error budget is 1 minus the SLO, e.g. 43.2 minutes per month at 99.9%.
- Metrics, logs, and traces
- Metrics are cheap aggregated numbers, logs are discrete high-volume events, and traces follow one request across services via propagated span and trace identifiers.
- Cardinality explosion
- Attaching high-cardinality labels such as user ID or request ID to metrics multiplies time series, inflating storage cost and query latency; keep those in logs or traces.
- Symptom-based alerting
- Alerting on user-impacting signals such as SLO burn rate rather than on internal causes like CPU spikes, so pages correspond to real degradation and reduce alert fatigue.
- Least privilege
- Granting only the actions required on only the resources required, preferring assumable roles and short-lived tokens over long-lived static access keys.
- Secrets rotation
- Periodically replacing credentials in a managed secret store and revoking the old value, triggered on schedule or on suspected compromise, without embedding secrets in code.
- Default-deny network policy
- Security groups and network policies start by blocking all traffic, then explicitly allow required flows, limiting lateral movement if a workload is compromised.
- Tamper-evident audit log
- An append-only record of access and configuration changes, stored in a separate account or role from the workloads, providing evidence for compliance frameworks such as SOC 2.
- Spot versus reserved capacity
- Spot or preemptible instances are cheap but interruptible, suited to fault-tolerant batch. Reserved or committed capacity discounts fit steady baseline load. Never run single-instance stateful workloads on spot.
- Right-sizing
- Matching instance type or container request to observed p95 utilization, so capacity is not paid for but unused while still absorbing normal peaks.
- Egress cost
- Data transferred out of a region or provider is typically billed while ingress is free; co-locating chatty services reduces this hidden cost.