JNCIA-Cloud flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

NIST cloud definition

A model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources that can be rapidly provisioned and released with minimal management effort.

Measured service

A cloud characteristic in which the provider automatically controls and reports resource usage, giving transparency to both provider and consumer. It enables pay-per-use billing and chargeback.

Resource pooling

A cloud characteristic where provider computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned.

IaaS

Infrastructure as a Service delivers virtualized compute, storage, and networking. The customer manages the operating system, middleware, runtime, and application while the provider manages the physical layer.

PaaS

Platform as a Service provides a managed runtime, middleware, and deployment tooling. The customer deploys code and data while the provider manages servers, operating systems, and scaling of the platform.

Type 1 hypervisor

A hypervisor that runs directly on the physical hardware without an underlying host operating system, such as ESXi or KVM. It typically offers better performance and a smaller attack surface.

Vertical vs horizontal scaling

Vertical scaling adds CPU or memory to an existing instance and is bounded by instance size. Horizontal scaling adds or removes instances and is bounded by application design.

Shared responsibility model

The division of security duties between provider and customer. The provider secures facilities and virtualization; the customer secures identity, data, and configuration, with the split varying by service model.

VPC

A Virtual Private Cloud is an isolated virtual network within a provider region, defined by an address range and divided into subnets. It controls routing, gateways, and network access policy.

Availability zone

One or more discrete data centers with independent power, cooling, and networking inside a region. Subnets are scoped to a single zone, and multi-zone deployment provides fault isolation.

Internet gateway

A horizontally scaled, redundant VPC component that allows communication between resources in the VPC and the internet, performing network address translation for instances with public addresses.

NAT gateway

A managed component that lets resources in private subnets initiate outbound connections to the internet while preventing unsolicited inbound connections, using a public address for translation.

Stateful security group

An instance-level firewall that permits rules by protocol, port, and source. It is stateful, so return traffic for an allowed connection is automatically permitted without a reverse rule.

Stateless network ACL

A subnet-level rule set evaluated in numbered order with an implicit final deny. It is stateless, so return traffic requires an explicit rule allowing the ephemeral port range.

VPC peering

A direct private connection between two VPCs using their private addresses. It is non-transitive, so a VPC cannot reach a third VPC through a peered partner.

Transit gateway

A regional hub that connects many VPCs, VPNs, and dedicated links through a single attachment point, providing transitive routing that peering alone cannot deliver.

Longest prefix match

The routing rule that selects the most specific matching route. A /24 route to a specific destination wins over a /16 route covering the same address.

Private hosted zone

A DNS zone that resolves only for queries originating from associated VPCs, allowing internal names to differ from public records for the same domain.

Layer 7 load balancer

A load balancer that inspects HTTP headers, host, and path to route requests, and can terminate TLS, rewrite requests, and perform content-based routing across target groups.

CIDR usable hosts

For a subnet with prefix length p, total addresses are 2 raised to the power of 32 minus p. Usable host count subtracts network, broadcast, and provider-reserved addresses.

Least privilege

Granting only the permissions required to perform a task, for the shortest practical duration. It limits blast radius when credentials are misused or a component is compromised.

Explicit deny

In policy evaluation, a deny statement overrides every allow statement. A request allowed by one policy is still rejected if any applicable policy explicitly denies it.

Temporary credentials

Short-lived credentials issued by assuming a role, with automatic expiration and rotation. They avoid long-lived access keys stored in code, configuration files, or instance images.

Envelope encryption

A scheme where a master key encrypts data keys, and data keys encrypt the data. Rotating the master key does not require re-encrypting the stored data.

Customer-managed key

An encryption key created and controlled by the customer, with its own key policy and rotation schedule. It separates key administration from data access duties.

Web application firewall

A layer 7 filter that inspects HTTP requests for injection, cross-site scripting, and bad bot signatures, blocking or rate-limiting traffic before it reaches the application.

Cloud audit log

A record of control-plane API calls showing who did what, when, and from where. It is the core evidence source for investigations and compliance monitoring.

Secrets manager

A service that stores credentials and API keys encrypted, controls access by policy, and rotates values automatically, removing secrets from code and configuration files.

Infrastructure as Code

Managing infrastructure through versioned machine-readable templates rather than manual console steps, enabling review, repeatability, and rollback of environment changes.

Idempotency

The property that applying the same operation repeatedly produces the same end state. It lets automation re-run safely after partial failure without duplicating resources.

State locking

A mechanism that prevents two concurrent automation runs from modifying the same infrastructure state, avoiding corruption and conflicting changes to deployed resources.

Autoscaling target tracking

A policy that adjusts capacity to hold a chosen metric, such as average CPU utilization, near a target value, scaling out and in as demand changes.

Orchestration

Coordinating multiple automated tasks across services, enforcing order, dependencies, and error handling, as opposed to automating one task in isolation.