NAVER Cloud Platform Certified Professional cheat sheet

NAVER Cloud Platform organizes resources by Region → Zone → VPC → Subnet; a Zone maps to an independent data center footprint, and multi-zone placement is the baseline for high availability.

The platform console, API (REST with HMAC-style signing), CLI, and SDKs all act on the same resource model, so anything created in the console is addressable by API using the same resource identifiers.

Services are grouped into categories: Compute, Storage, Database, Networking, Security, Management/Monitoring, Application Services, AI/Data, and Hybrid; certification domains map roughly one-to-one onto these groups.

Classic vs VPC environments: legacy Classic resources (e.g., Classic load balancers, Classic object storage endpoints) are isolated from VPC-scoped resources, and cross-environment communication requires explicit bridging such as a proxy or VPN.

Resource naming and tagging: every resource carries a name, a platform-generated instance/resource ID, and optional tags; tags are the primary mechanism for cost allocation and for filtering in monitoring.

Billing is pay-as-you-go with per-second or per-hour metering depending on service; stopped-but-allocated servers may still incur storage/IP charges, so contract termination, not power-off, stops billing.

Architecture rule: place stateless web/app tiers across at least two zones behind a load balancer, keep stateful tiers (DB, cache) in a dedicated subnet, and expose only the load balancer in a public subnet.

Regional vs global services: compute, block storage, and VPC are regional; CDN, DNS, and some AI endpoints are global-facing and are configured once rather than per zone.

Server (VM) creation requires image, spec type (e.g., Standard/High-CPU/High-Memory/GPU), zone, subnet, and login key; the login key is generated once and the private key cannot be re-downloaded.

Spec types are fixed bundles of vCPU and memory; changing spec requires a stop-and-start, while adding block storage can be done online.

Server lifecycle states include creating, running, stopped, and terminated; a terminated server releases the public IP unless a reserved public IP was attached.

Auto Scaling uses launch configurations plus policies (target-tracking on CPU/memory, schedule-based, or manual) and scales within a defined min/max group size.

Kubernetes Service (NKS) clusters have a control plane managed by the platform and worker node pools you size per zone; node pools can be scaled and upgraded independently.

NKS integrates with Container Registry, Load Balancer (for Service type LoadBalancer), and IAM; cluster access uses kubeconfig issued from the console.

Container Registry stores Docker/OCI images per namespace/repository; images are pulled by NKS nodes through an auth secret or an attached service account.

GPU and bare-metal spec types are available for AI/ML workloads; bare metal is chosen when hypervisor overhead or custom kernels are unacceptable.

Object Storage buckets are flat namespaces with object keys; access is controlled by bucket policy and IAM, and storage classes (standard, infrequent, archive) trade retrieval latency for cost.

Block Storage is attached to a single server in one zone; it is the correct choice for a database data directory, whereas Object Storage is not a filesystem and must not back a live DB.

NAS (Network Attached Storage) provides shared NFS/SMB mounts across multiple servers; use it for shared file content, not for high-IOPS transactional DB files.

Archive Storage and Object Storage archive tiers apply retrieval fees and minimum retention; moving data back to hot tiers incurs a restore delay.

Cloud DB for MySQL/PostgreSQL/Redis/MSSQL are managed: the platform handles backup, patching, failover to a standby, and parameter groups; you choose spec and storage, not the OS.

Managed DB failover uses a primary plus standby in a different zone; connection endpoints (primary vs read-only/standby) are separate hostnames, so applications must use the correct endpoint.

Redis (Cloud DB for Redis) is for caching/session state; it is not a durable system of record, and eviction policy plus maxmemory must be configured explicitly.

Data transfer into the platform is generally free while egress to the internet is billed; cross-zone traffic within a region is typically cheaper than cross-region.

A VPC defines an IP CIDR (private range); subnets carve that range and are either public (routable to the internet gateway) or private (outbound only via NAT Gateway).

Access Control Group (ACG) is a stateful virtual firewall attached to servers, with allow-only rules and separate inbound/outbound sets; default deny applies to unmatched traffic.

Load Balancer types: Application LB (HTTP/HTTPS, layer 7, path/host routing, TLS termination) and Network LB (TCP/UDP, layer 4, preserves source IP); both need a target group and health check.

Health check failures remove targets from rotation; configure interval, timeout, and healthy/unhealthy thresholds so a slow-starting app is not flapped.

Global DNS (record sets A/AAAA/CNAME/MX/TXT) supports weighted and failover routing; TTL controls how long resolvers cache a change, so lower TTL before a cutover.

CDN caches static content at edge PoPs keyed by URL and cache-control headers; purge the cache after origin changes, and use signed URLs/tokens for private content.

Site-to-Site VPN connects an on-premises gateway to the VPC over IPsec with pre-shared keys and BGP or static routing; bandwidth is bounded by the VPN gateway and internet path.

Route tables decide next hop: internet gateway for public subnets, NAT Gateway for private-subnet egress, and VPN gateway or transit path for hybrid traffic.

IAM principals are users, groups, and roles; permissions are granted via policies attached to those principals, and effective permission is the union of all attached policies.

Sub-accounts are the normal operating model: the main account holds billing and creates sub-accounts; each sub-account gets its own credentials and least-privilege policies.

Access key (API key) pairs are used for programmatic access and must be rotated; console login for sub-accounts can be protected with MFA and IP allowlists.

Security Monitoring services include IPS/IDS-style detection, web firewall (WAF) rules for OWASP-class attacks, and anti-DDoS; WAF sits in front of the load balancer or origin.

Key Management Service stores and rotates encryption keys; Object Storage, Block Storage, and managed DB encryption reference KMS keys rather than embedding secrets in code.

Secrets Manager holds DB passwords and API tokens with rotation; applications fetch at runtime by secret reference instead of hardcoding values.

Certificate Manager issues/manages TLS certificates used by load balancers and CDN; certificate expiry is a common outage cause, so track renewal dates.

Audit trail: admin and API actions are recorded in activity logs; forward logs to a central store for retention, since default retention is limited.

Monitoring (Cloud Insight-style) collects metrics per resource: CPU, memory (requires the agent), disk, network, and custom metrics; dashboards group them by tag or resource.

Alarms are metric + condition + duration + action (notify via email/SMS/webhook, or trigger Auto Scaling); a condition without a sustained duration causes alert noise.

Agent-based metrics (memory, disk usage, process count) are unavailable until the monitoring agent is installed on the server.

Cloud Functions (serverless) runs event- or HTTP-triggered code with per-invocation billing; use it for glue tasks, not for long-running stateful jobs.

Automation via API/CLI plus scheduled scripts replaces manual console work; idempotent create-or-update logic prevents duplicate resources on retries.

Log collection: install the log agent to ship system/application logs to the central log service, then query and alert on patterns.

Change tracking: use tags plus naming conventions per environment (dev/stg/prod) so cost reports and alarms can be scoped without manual lists.

Maintenance windows and notification contacts should be set per resource group so patching and failover events reach the right on-call owner.

AI services are consumed as APIs: Speech-to-Text/Text-to-Speech, Vision (OCR, face/object detection), and language services (translation, sentiment, summarization) are called with an API key and per-request billing.

Generative AI endpoints follow the same pattern: send prompt/parameters, receive completion; token limits and rate limits are per key and must be handled with retry/backoff.

Data platform components: Object Storage as the data lake, managed Hadoop/Spark-style analytics clusters for batch, and a managed search/analytics engine for log and text indexing.

Map and location services provide geocoding, reverse geocoding, directions, and static/dynamic maps via API with usage-based quotas.

Messaging: a queue/topic service decouples producers and consumers; at-least-once delivery means consumers must be idempotent.

Content delivery of AI outputs (e.g., TTS audio) is best written to Object Storage and served via CDN rather than streamed repeatedly through the API.

Pipeline rule: keep raw data immutable in Object Storage, transform into a curated layer, and register schemas so downstream consumers do not break on format change.

Quotas: most AI/data APIs have per-second call limits; batch jobs should throttle and checkpoint progress so a quota error does not restart the whole job.

Migration order: inventory and dependency-map first, then move stateless tiers, then databases (with replication cutover), then decommission; databases last because they carry state.

Database migration path: set up a replica or dump/restore to the managed DB, verify, then switch the application endpoint during a low-traffic window with a rollback plan.

Hybrid connectivity options: Site-to-Site VPN for quick/low-cost links, dedicated private connection for predictable latency and bandwidth; routing must be planned on both sides.

Cost levers: right-size specs (most VMs are over-provisioned), use reserved/contract pricing for steady-state, stop or terminate idle dev resources, and delete unattached block storage and old snapshots.

Egress is the most commonly underestimated cost: serve static assets via CDN, keep chatty service-to-service traffic inside the VPC, and avoid cross-region calls in hot paths.

Cost visibility: tag everything, review billing by tag/service monthly, and set budget alarms so anomalies (e.g., a runaway autoscale group) surface early.

Operational excellence: infrastructure as code for repeatable environments, blue/green or canary deployment via load balancer target groups, and tested backup/restore, not just backups.

Well-architected check: multi-zone for every tier, least-privilege IAM, alarms on the four golden signals (latency, traffic, errors, saturation), and documented runbooks for failover.

Region → Zone → VPC → Subnet hierarchy; multi-zone placement is the baseline for high availability.

Console, API, CLI, and SDKs operate on one shared resource model with the same resource identifiers.

Classic and VPC environments are isolated; cross-environment traffic needs an explicit bridge such as a proxy or VPN.

Tags drive cost allocation and monitoring filters; names and platform IDs are separate attributes.

Stopped servers may still incur storage and IP charges; only termination stops compute billing.

Stateless tiers go in public subnets behind a load balancer; stateful tiers stay in private subnets.

Compute, block storage, and VPC are regional; CDN and DNS are configured globally.

Server creation needs image, spec type, zone, subnet, and login key; the private key is shown once only.

Spec changes require stop/start; attaching block storage can be done while running.

Auto Scaling = launch configuration + policy (target tracking, schedule, manual) within min/max bounds.

NKS manages the control plane; you size and upgrade worker node pools per zone independently.

NKS pulls images from Container Registry via auth secret or attached service account.

Service type LoadBalancer in NKS provisions a platform load balancer automatically.

Bare-metal and GPU specs exist for workloads needing no hypervisor overhead or accelerators.

Object Storage is a flat key namespace with bucket policies and tiered storage classes; it is not a filesystem.

Block Storage attaches to one server in one zone and is the right backing for DB data directories.

NAS gives shared NFS/SMB mounts across servers; avoid it for high-IOPS transactional DB files.

Archive tiers add retrieval fees and minimum retention plus restore delay before data is hot again.

Managed DBs handle backup, patching, and cross-zone failover; you choose spec and storage, not the OS.

Primary and read-only/standby endpoints are distinct hostnames; apps must target the correct one.

Redis is for cache and session state, not a durable system of record; set maxmemory and eviction explicitly.

Ingress traffic is generally free; internet egress and cross-region transfer are billed.

VPC CIDR is subdivided into public (internet gateway) and private (NAT Gateway egress) subnets.

ACG is a stateful, allow-only firewall on servers; unmatched traffic is denied by default.

Application LB = layer 7 with path/host routing and TLS termination; Network LB = layer 4 TCP/UDP preserving source IP.

Health check interval, timeout, and thresholds must tolerate app slow start or targets will flap.

DNS record sets support weighted and failover routing; lower TTL before a planned cutover.

CDN keys cache on URL plus cache-control; purge after origin changes and use signed URLs for private content.

Site-to-Site VPN is IPsec with pre-shared keys and BGP or static routes; throughput is bounded by the gateway and internet path.

Route table next hops: internet gateway, NAT Gateway, or VPN gateway per subnet need.

Effective permission = union of all policies attached to user, group, and role.

Main account holds billing; sub-accounts get separate credentials and least-privilege policies.

API access keys must be rotated; console access can require MFA and IP allowlists.

WAF blocks OWASP-class attacks in front of the load balancer; anti-DDoS and IPS cover other layers.

KMS holds and rotates encryption keys referenced by Object Storage, Block Storage, and managed DB.

Secrets Manager stores and rotates DB passwords and tokens; fetch by reference at runtime.

Certificate Manager issues TLS certs for LB and CDN; track expiry to avoid outages.

Admin and API actions land in activity logs with limited default retention; forward to central storage.

Alarm = metric + condition + sustained duration + action (notify or trigger scaling).

Memory, disk usage, and process metrics require the monitoring agent on the server.

Cloud Functions is event/HTTP-triggered and per-invocation billed; unsuitable for long-running stateful jobs.

Idempotent create-or-update automation prevents duplicate resources when API retries occur.

Log agent ships system and app logs to the central log service for query and pattern alerts.

Environment-scoped tags and naming let cost reports and alarms avoid manual resource lists.

Set maintenance windows and notification contacts per resource group to reach the right on-call owner.

AI APIs (STT/TTS, OCR, vision, translation, summarization) are key-authenticated and billed per request.

Generative AI calls need retry with backoff for token and rate limits per key.

Data lake pattern: raw immutable data in Object Storage, curated transforms downstream, registered schemas.

Managed analytics clusters handle batch Spark-style jobs; search engine indexes logs and text.

Map/location APIs cover geocoding, reverse geocoding, directions, and static/dynamic maps.

Queue/topic messaging is at-least-once, so consumers must be idempotent.

Persist generated media (e.g., TTS audio) to Object Storage and serve via CDN instead of re-calling the API.

Throttle and checkpoint batch jobs so a quota error does not restart the whole run.

Migrate in order: inventory/dependency map, stateless tiers, databases with replication cutover, then decommission.

DB cutover: replicate to managed DB, verify, switch endpoint in a low-traffic window with rollback ready.

Hybrid link choice: Site-to-Site VPN for quick low-cost, dedicated private connection for predictable bandwidth.

Cost levers: right-size specs, contract pricing for steady state, terminate idle dev resources, delete orphan disks and snapshots.

Egress dominates surprise bills: CDN for static assets, keep service-to-service traffic inside the VPC.

Budget alarms plus tag-based billing review surface runaway autoscale and orphaned resources early.

Deploy via infrastructure as code with blue/green or canary through LB target groups.

Alarm on latency, traffic, errors, and saturation; test restore, not just backup, and keep failover runbooks.

Login key pair is created at first server launch; the private key download is one-time.

Login key pairs are account-scoped and can be reused across servers in the same account.

Auto Scaling policies can also be schedule-based for predictable daily peaks.

NKS node pools can mix spec types so GPU and general workloads share one cluster.

Container Registry repositories are namespaced; image tags are mutable, so pin digests in production.

Terminating a server without a reserved public IP releases the address; reserve it to keep it.

Snapshots of block storage are incremental and restorable to a new volume in the same zone scope.

Object Storage lifecycle rules move objects between tiers or expire them automatically.

Managed DB backups have a retention window; point-in-time restore depends on that window.

Parameter groups change DB engine settings without manual OS access but may need a restart.

Read replicas or read-only endpoints offload reporting queries from the primary.

Cross-region replication for Object Storage supports DR but adds transfer cost.

Subnets cannot overlap within a VPC; plan CIDR ranges before creating resources.

ACG rules reference source/destination CIDR or ACG, and one server can carry multiple ACGs.

Target groups can be IP-based or instance-based; IP targets enable hybrid backends.

TLS termination at the LB offloads crypto but requires the cert to live in Certificate Manager.

CDN origin can be Object Storage or a load balancer; choose based on whether content is static or dynamic.

DNS failover routing needs health checks to detect an unhealthy endpoint.

Roles let services assume permissions without static keys, e.g., a function writing to Object Storage.

Policy conditions can restrict by source IP, time, or resource tag for finer control.

Bucket policies and IAM policies both apply to Object Storage; the effective result is the intersection for cross-account access.

Security monitoring alerts should route to the same on-call channel as availability alarms.

Disable or delete unused access keys and sub-accounts during periodic access reviews.

Encryption at rest and in transit are configured separately; TLS on the LB does not encrypt stored data.

Dashboards can combine metrics from multiple services into one view per environment.

Alarm actions can include webhooks, enabling integration with external incident tools.

Cloud Functions triggers include HTTP, schedule, and object storage events.

API rate limits apply to automation scripts; batch calls and handle throttling responses.

Retention differs between activity logs and application logs; confirm before relying on either for audit.

Resource groups by tag simplify bulk operations such as patching or scaling.

OCR and vision APIs return structured JSON with confidence scores; validate thresholds before acting.

TTS/STT support multiple voices and languages; language and voice are request parameters.

Translation and sentiment APIs are stateless, so context must be supplied per request.

Search/analytics engines index JSON documents and support full-text queries plus aggregations.

Batch analytics clusters can read directly from Object Storage as the data lake layer.

API keys for AI services should be scoped per application to isolate quota and revoke independently.

Dependency mapping prevents migrating an app whose database or auth service is still on-premises.

Private dedicated connections need lead time; VPN is the interim path during migration.

Reserved or contract pricing pays off only for workloads with stable 24/7 utilization.

Unattached block storage and stale snapshots are silent recurring costs; audit monthly.

Cross-zone traffic is cheaper than cross-region; keep chatty calls in one region.

Canary release shifts a small traffic percentage to the new target group before full cutover.

Runbooks should name the alarm, the first diagnostic step, and the rollback action.

A zone failure should degrade capacity, not availability; design so any single zone can be lost.

Service quotas exist per account and per region; request increases before a launch, not during it.

The same resource may appear under different console menus by category, but its ID is unique across the account.

Hybrid and on-premises connectivity is a first-class part of the architecture, not an afterthought.

Cost and security reviews belong at design time because retrofitting subnets, IAM, and tags is expensive.

Document which resources are regional vs global so DR plans place them correctly.

Init scripts and user data run at first boot; use them to bootstrap agents and app config.

Server images can be captured from a running server to standardize future launches.

NKS supports rolling upgrades of node pools; cordon and drain before replacing nodes.

Cluster autoscaling and pod autoscaling are separate controls and are often confused.

Registry image vulnerability scanning should run before deploying to production clusters.

Place worker nodes across multiple zones so a zone loss does not empty the cluster.

Choose storage by access pattern: object for blobs, block for DB files, NAS for shared files.

Managed DB high availability requires selecting a standby; single-instance setups have no automatic failover.

Connection pooling matters because managed DB max_connections is bounded by spec.

Backup restore should be rehearsed into a separate instance to validate recovery time.

Object Storage versioning protects against overwrite and delete but increases stored bytes.

Storage class changes are not always instant; account for transition and retrieval latency.

NAT Gateway is regional and must sit in a public subnet to give private subnets egress.

Security groups (ACG) versus network ACLs: ACGs are stateful and instance-level; plan rule scope accordingly.

Load balancer idle timeout must exceed the slowest backend response or connections drop.

Sticky sessions are needed for stateful apps behind a layer 7 load balancer.

CDN cache hit ratio is the key cost and latency metric; low hit ratio means poor cache-control headers.

VPN tunnel redundancy (two tunnels) prevents a single IPsec failure from cutting hybrid traffic.

Least privilege means starting from deny and adding specific actions and resources, not starting from admin.

Separate human identities from machine identities; machines should use roles, not shared keys.

KMS key deletion is often delayed or irreversible; disable first and confirm nothing references it.

WAF rules need tuning to avoid blocking legitimate traffic; monitor block rates after changes.

Log retention for security events should exceed the incident detection window.

Periodic access reviews catch stale sub-accounts and orphaned keys that outlive their project.

Alert on symptoms users feel (error rate, latency) rather than only on CPU percentage.

Dashboards per environment prevent prod metrics from being hidden by dev noise.

Automation should log every API call it makes so failures are reproducible.

Scheduled scaling ahead of known peaks beats reactive scaling that lags traffic.

Tag-based cost and monitoring filters must be applied at creation, not retrofitted.

Keep a tested rollback for every automated change; automation amplifies mistakes as fast as fixes.

AI API latency varies by payload size; set client timeouts above the p99, not the average.

Cache deterministic AI results (e.g., repeated OCR of the same image) to cut cost.

Store model inputs and outputs for evaluation and audit, respecting data retention policy.

Data pipelines should validate schema at ingestion to fail fast rather than corrupt the curated layer.

Search indexes need a refresh strategy; stale indexes return outdated results.

Quota planning per API key prevents one application from starving another.

Migration success criteria should include rollback time, not just cutover date.

Hybrid DNS must resolve on-premises names from the VPC and vice versa; plan forwarding rules.

Right-sizing should be based on observed p95 utilization over weeks, not a single sample.

Autoscale maximums are a cost control; unbounded max is a common budget surprise.

Operational excellence includes blameless postmortems that feed back into runbooks and alarms.

Well-architected reviews should be scheduled periodically, not only before launch.

Multi-zone placement is the default HA pattern for every tier.

One resource model is shared by console, API, CLI, and SDK.

Classic and VPC resources are isolated without an explicit bridge.

Tags drive cost allocation and monitoring scope.

Termination, not stop, ends compute billing.

Stateless tiers public behind LB; stateful tiers private.

Compute and VPC are regional; CDN and DNS are global.

Login key private download is one-time; store it securely at creation.

Spec change needs stop/start; block storage attaches online.

Auto Scaling needs a launch configuration and a policy within min/max.

NKS manages control plane; you own worker node pools.

Registry auth for NKS uses a secret or service account.

Service type LoadBalancer auto-provisions a platform LB.

GPU and bare-metal specs serve AI and custom-kernel workloads.

Object Storage = flat keys, not a filesystem.

Block Storage = one server, one zone, DB-appropriate.

NAS = shared NFS/SMB, not high-IOPS DB files.

Archive tiers add retrieval fees and restore delay.

Managed DB handles backup, patching, cross-zone failover.

Primary and standby endpoints are different hostnames.

Redis is cache, not durable storage.

Egress and cross-region transfer are billed.

Public subnets use an internet gateway; private subnets use NAT Gateway.

ACG is stateful with allow-only rules and default deny.

Layer 7 LB for HTTP routing and TLS; layer 4 for TCP/UDP source IP.

Health check thresholds must tolerate app slow start.

Lower DNS TTL before cutover; weighted and failover routing available.

CDN cache keys on URL and cache-control; purge after origin change.

Site-to-Site VPN is IPsec with BGP or static routes.

Route tables choose next hop per subnet.

Effective permission is the union of attached policies.

Main account for billing; sub-accounts for operations.

Rotate API keys; MFA and IP allowlists for console access.

WAF in front of LB blocks OWASP-class attacks.

KMS keys back storage and DB encryption.

Secrets Manager rotates credentials fetched at runtime.

Certificate Manager certs expire; track renewal.

Activity logs have limited retention; forward centrally.

Alarm = metric + condition + duration + action.

Memory and disk metrics need the monitoring agent.

Cloud Functions is event-driven and per-invocation billed.

Idempotent automation prevents duplicates on retry.

Log agent feeds the central log service.

Environment tags scope cost reports and alarms.

Notification contacts per resource group reach the right on-call.

AI APIs are key-authenticated and per-request billed.

Retry with backoff on token and rate limits.

Raw immutable data in Object Storage; curated layer downstream.

Managed analytics clusters run batch jobs; search engine indexes text.

Map APIs cover geocoding and directions.

Queue delivery is at-least-once; consumers must be idempotent.

Persist generated media to Object Storage and serve via CDN.

Checkpoint batch jobs to survive quota errors.

Migrate stateless first, databases last with replication cutover.

VPN is the interim hybrid link; dedicated connection for steady bandwidth.

Contract pricing only for stable 24/7 workloads.

Delete orphan disks and snapshots monthly.

Egress is the top surprise cost; CDN and VPC-internal traffic reduce it.

Budget alarms catch runaway autoscale early.

Canary and blue/green via LB target groups.

Alarm on latency, traffic, errors, saturation; test restore.