JNCIA-Cloud key terms

One shared pool of compute, storage, and network resources serves many independent customers, with logical separation between them so each tenant sees only its own workloads and data.

A contractual commitment that states measurable performance and availability targets, such as 99.9 percent uptime, plus the remedies a customer receives when those targets are missed.

A cloud model that delivers virtual machines, storage volumes, and virtual networks on demand, leaving the guest operating system and everything above it to the customer.

A cloud model where the provider manages servers, runtime, and scaling, and the customer deploys only application code and configuration through a supported framework or buildpack.

A fully provider-operated application delivered over the internet, where the customer manages only its own users, data, and configuration rather than any underlying infrastructure.

Provider-owned infrastructure shared across many customers and reached over the internet, billed on measured consumption and provisioned through self-service APIs and portals.

Cloud-style self-service and automation delivered on infrastructure dedicated to a single organization, whether hosted on premises or by a third party.

An environment that connects private infrastructure with public cloud services so workloads and data can move between them under common management and policy.

A software-defined computer with its own virtual CPU, memory, disk, and network interfaces, running under a hypervisor independently of the physical host.

The software layer that creates and runs virtual machines, allocating physical CPU, memory, and I/O among guests while keeping them isolated from one another.

A packaged application and its dependencies that share the host operating system kernel, starting quickly and running identically across environments.

An application style that splits functionality into small independently deployable services that communicate over network APIs, allowing each to scale and release separately.

An execution model where the provider runs code on demand and scales it automatically, billing per request or execution time with no server provisioning by the customer.

Automatically adding or removing instances based on metrics such as CPU utilization or request rate, keeping capacity matched to demand without manual intervention.

The ability to rapidly expand and contract resource capacity as workload demand changes, so cost and performance track actual usage rather than peak estimates.

Running baseline workloads in private infrastructure and spilling overflow demand to public cloud resources during peak periods, then releasing them when demand falls.

A logically isolated network within a cloud provider where you define your own address ranges, subnets, and routing, separate from other customers' networks.

A contiguous range of IP addresses carved from a VPC or virtual network, used to place instances and control routing and access boundaries.

A set of rules that tells a virtual network where to send traffic matching a destination prefix, typically pointing to a gateway, appliance, or peering connection.

A managed virtual router attached to a VPC that provides a path between public subnets and the internet, performing address translation for outbound and inbound flows.

Rewriting source or destination IP addresses as packets cross a boundary, letting private addresses reach external networks or allowing many hosts to share one public address.

A stateful virtual firewall attached to instances or interfaces that permits only explicitly allowed inbound and outbound traffic, with return traffic automatically permitted.

A stateless, ordered list of permit and deny rules applied at the subnet boundary, evaluating both directions of traffic independently of security groups.

A direct private network connection between two VPCs that routes traffic over the provider backbone without traversing the public internet.

A central hub that connects many VPCs, remote sites, and on-premises networks through a single attachment point, simplifying routing instead of building full-mesh peering.

A managed endpoint that terminates encrypted IPsec tunnels between a cloud network and a remote site or another cloud over the public internet.

A private physical circuit between a customer site and a cloud provider's network edge, offering predictable latency and higher bandwidth than internet-based VPN tunnels.

A service that distributes incoming requests across multiple backend instances using health checks and algorithms such as round robin or least connections.

A periodic probe that tests whether a backend endpoint responds correctly, so traffic is steered away from failed instances automatically.

A globally distributed set of edge caches that serves content close to users, reducing latency and origin load by storing copies of frequently requested objects.

The system that authenticates users and workloads and authorizes their actions through policies, roles, and permissions scoped to specific resources.

Granting permissions to roles rather than individual users, so people or services inherit exactly the access their assigned role allows.

The practice of granting only the permissions needed to perform a specific task, for the shortest practical time, limiting the damage from credential misuse.

Requiring two or more independent proofs of identity, such as a password plus a one-time code, so a stolen password alone cannot grant access.

A trusted service that authenticates users and issues assertions about their identity, enabling single sign-on across applications through standards such as SAML or OpenID Connect.

A mechanism where one successful authentication grants access to multiple applications without prompting for credentials again, typically brokered by an identity provider.

Trusting an external identity provider's authentication decisions so users from another organization or directory can access resources without separate local accounts.

Protecting stored data by encrypting volumes, objects, or databases with managed keys, so physical media or snapshots are unreadable without authorization.

Protecting data while it moves between systems by using protocols such as TLS or IPsec, preventing eavesdropping and tampering on the path.

A managed service that creates, stores, rotates, and audits cryptographic keys and controls which identities may use them for encryption operations.

A tamper-resistant device that stores cryptographic keys and performs cryptographic operations inside protected hardware, so keys never appear in plaintext on general-purpose systems.

The division of security duties between provider and customer: the provider secures the cloud infrastructure, while the customer secures its own data, identities, and configurations.

Meeting externally defined legal, regulatory, or industry requirements such as data protection laws or payment card standards, often evidenced through audits and certifications.

The requirement that data remains stored and processed within specified geographic boundaries, driven by law, contract, or organizational policy.

A suite of protocols that authenticates and encrypts IP packets between peers, commonly used to build site-to-site VPN tunnels over untrusted networks.

Automated coordination of many resources and tasks so they are provisioned, configured, sequenced, and torn down as one repeatable workflow rather than by hand.

Defining networks, compute, and policies in version-controlled declarative files that a tool applies to create or change resources consistently and repeatably.

Describing the desired end state of a system and letting a tool determine the steps to reach it, rather than scripting each step explicitly.

A property where applying the same operation repeatedly produces the same result, so rerunning automation does not create duplicates or unintended changes.

Tools and practices that keep systems in a defined state, installing packages, managing files and services, and correcting drift on managed hosts.

A model where servers are never patched in place; instead a new image is built and deployed to replace the old one, simplifying rollback and consistency.

An open-source container orchestrator that schedules containers across a cluster, restarts failed ones, and provides service discovery, scaling, and rolling updates.

A layered, read-only artifact containing an application and its dependencies, used to start containers reproducibly on any compatible runtime.

An automated sequence that builds, tests, and deploys code changes, giving fast feedback and repeatable releases from commit to production.

A defined programmatic interface that lets software request actions or data from a service, forming the basis of cloud provisioning and automation.

Workflows triggered by signals such as an alert, a file upload, or a threshold breach, running predefined actions without a person initiating them.

Running two identical environments and switching traffic from the live one to the updated one, enabling near-instant rollback if the release fails.