NIFCLOUD Certified Associate cheat sheet

NIFCLOUD is a Japanese public cloud operated by Fujitsu; the control surface is a web console plus APIs, with compute, storage, networking, and DNS offered as discrete services.

Core compute service is the virtual server (instance) running on a chosen OS image; block storage attaches as a disk, and a private network segment hosts the server's NIC.

Service families map to exam domains: compute = virtual servers and images; storage = disk (block), object storage, and archive; networking = private networks, load balancers, DNS, and VPN gateways.

Region/zone model: resources are placed in a region containing multiple zones; a zone is an isolated failure domain, so multi-zone placement reduces single-failure exposure.

Contract/billing model is subscription-based with monthly invoicing; the console exposes usage and billing information per resource, and an API key (access key) authenticates programmatic calls.

Identity is account-based: an account owns resources, and sub-users/operators can be granted scoped permissions rather than sharing the primary account credentials.

Resource naming and tagging are the primary means of grouping resources for cost tracking and operational filtering; tags are free-form key/value metadata.

API-first design: every console action corresponds to an API call, so automation via CLI/SDK is functionally equivalent to the console.

A virtual server is defined by: image (OS template), flavor/type (CPU and memory size), disk(s), network interface(s), and zone placement.

Changing CPU/memory means changing the server type; the server must typically be stopped before a type change, and the change is applied to the existing disk.

Images are the boot source; a custom image can be captured from an existing server's disk, and images are zone/region-scoped, so copying is required for cross-region use.

A server gets a private IP on its attached private network; public reachability is added separately via a global/public IP or a load balancer, not automatically.

Deleting a server does not necessarily delete its attached disk - the disk is a separate resource and must be released explicitly to stop billing.

Server lifecycle states: creating/building, running, stopped, and deleted; a stopped server still consumes disk capacity and its disk charges continue.

Initial login uses the key pair (SSH public key) specified at creation or an administrator password set at creation; losing both requires disk reattachment or rebuild.

Flavor selection rule: size for peak memory first, then vCPU; undersized memory causes OOM kills that look like application faults, not infrastructure faults.

Block storage (disk) is attached to one virtual server at a time, is zone-bound, and persists independently of the server lifecycle.

Disk size can be expanded, but shrinking a disk is not supported; expansion may require filesystem-level growth inside the guest OS.

Object storage stores objects in buckets addressed by key; access is over HTTP(S) API, suitable for static content, backups, and logs, not for mounting as a boot volume.

Object storage durability comes from redundancy within the service; versioning and lifecycle rules protect against overwrite and uncontrolled growth.

Archive storage trades retrieval latency for cost: retrieval is not instantaneous and is billed/queued, so it suits long-term retention, not active data.

Bucket naming is globally unique within the service endpoint; bucket policies and ACLs govern anonymous versus authenticated access.

Backup strategy rule: disk snapshots/images for server-level recovery, object storage for file-level and cross-region copies, archive for compliance retention.

Cost driver rule: block storage bills on provisioned capacity (regardless of used bytes), object storage bills on stored bytes plus requests and egress.

A private network is a tenant-scoped L2/L3 segment; servers on the same segment communicate by private IP without traversing the internet.

Subnets carve the private network into IP ranges; the CIDR must not overlap with networks reachable over VPN, or routing will fail.

A load balancer fronts one or more backend servers and health-checks them; unhealthy backends are removed from rotation automatically.

Listener protocol (HTTP/HTTPS/TCP) determines whether the balancer can inspect and route on L7 attributes or only forward L4 connections.

DNS service maps zone records (A, AAAA, CNAME, MX, TXT) to IPs or hostnames; record TTL controls how long resolvers cache, so lower TTL speeds failover.

VPN gateway connects the private network to an on-premises or other cloud network over IPsec; the peer's allowed CIDRs and pre-shared key must match on both sides.

Public IP assignment is a separate step from private IP; releasing a reserved public IP returns it to the pool and breaks any DNS record pointing at it.

Troubleshooting order: security group/packet filter rules, then route table/subnet association, then listener health check, then DNS resolution.

Authentication proves identity (account credentials, API key, SSH key); authorization decides which API actions are permitted on which resources.

Least privilege rule: grant the narrowest action set on the narrowest resource scope, and use separate identities per workload rather than one shared key.

API keys/secrets are bearer credentials: anyone holding them has the granted permissions, so rotate them and never embed them in source or images.

Network-layer control uses firewall/packet-filter rules on the server's interface; default-deny inbound with explicit allow rules is the safe baseline.

TLS termination at the load balancer offloads encryption and centralizes certificate management; traffic from balancer to backend may then be plaintext unless re-encrypted.

Audit trail: API operation logs record who called which action and when; they are the primary evidence for investigating unauthorized changes.

Key management rule: private keys stay client-side; the service stores the public key only, so a lost private key cannot be recovered from the cloud side.

Segmentation rule: place internet-facing servers in one segment and databases in another, allowing only the specific ports required between them.

Monitoring collects metrics at a sampling interval; a metric is a time series of (namespace, metric name, dimensions) and alarms evaluate thresholds over periods.

Alarm evaluation: threshold + comparison + consecutive periods; too short a period causes flapping, too long delays detection - set periods from the metric's natural cycle.

Common host metrics: CPU utilization, disk read/write, network in/out, and disk usage; disk-full is not visible from hypervisor metrics without a guest agent.

Logs and metrics are complementary: metrics detect that something changed, logs explain why; alert on metrics, investigate with logs.

Billing is metered per resource-hour or per provisioned unit; stopped servers still bill for attached disks, and released resources stop billing at release time.

Cost control levers: delete unattached disks and unused public IPs, right-size server types to actual utilization, and apply lifecycle rules to object storage.

Change management rule: snapshot/image before a type change or OS patch so rollback is a restore, not a rebuild.

Tagging discipline: assign owner and environment tags at creation; untagged resources cannot be attributed to a cost center in billing reports.

NIFCLOUD is a Japanese public cloud operated by Fujitsu; the control surface is a web console plus APIs, with compute, storage, networking, and DNS offered as discrete services.

Core compute service is the virtual server (instance) running on a chosen OS image; block storage attaches as a disk, and a private network segment hosts the server's NIC.

Service families map to exam domains: compute = virtual servers and images; storage = disk (block), object storage, and archive; networking = private networks, load balancers, DNS, and VPN gateways.

Region/zone model: resources are placed in a region containing multiple zones; a zone is an isolated failure domain, so multi-zone placement reduces single-failure exposure.

Contract/billing model is subscription-based with monthly invoicing; the console exposes usage and billing information per resource, and an API key (access key) authenticates programmatic calls.

Identity is account-based: an account owns resources, and sub-users/operators can be granted scoped permissions rather than sharing the primary account credentials.

Resource naming and tagging are the primary means of grouping resources for cost tracking and operational filtering; tags are free-form key/value metadata.

API-first design: every console action corresponds to an API call, so automation via CLI/SDK is functionally equivalent to the console.

A virtual server is defined by: image (OS template), flavor/type (CPU and memory size), disk(s), network interface(s), and zone placement.

Changing CPU/memory means changing the server type; the server must typically be stopped before a type change, and the change is applied to the existing disk.

Images are the boot source; a custom image can be captured from an existing server's disk, and images are zone/region-scoped, so copying is required for cross-region use.

A server gets a private IP on its attached private network; public reachability is added separately via a global/public IP or a load balancer, not automatically.

Deleting a server does not necessarily delete its attached disk - the disk is a separate resource and must be released explicitly to stop billing.

Server lifecycle states: creating/building, running, stopped, and deleted; a stopped server still consumes disk capacity and its disk charges continue.

Initial login uses the key pair (SSH public key) specified at creation or an administrator password set at creation; losing both requires disk reattachment or rebuild.

Flavor selection rule: size for peak memory first, then vCPU; undersized memory causes OOM kills that look like application faults, not infrastructure faults.

Block storage (disk) is attached to one virtual server at a time, is zone-bound, and persists independently of the server lifecycle.

Disk size can be expanded, but shrinking a disk is not supported; expansion may require filesystem-level growth inside the guest OS.

Object storage stores objects in buckets addressed by key; access is over HTTP(S) API, suitable for static content, backups, and logs, not for mounting as a boot volume.

Object storage durability comes from redundancy within the service; versioning and lifecycle rules protect against overwrite and uncontrolled growth.

Archive storage trades retrieval latency for cost: retrieval is not instantaneous and is billed/queued, so it suits long-term retention, not active data.

Bucket naming is globally unique within the service endpoint; bucket policies and ACLs govern anonymous versus authenticated access.

Backup strategy rule: disk snapshots/images for server-level recovery, object storage for file-level and cross-region copies, archive for compliance retention.

Cost driver rule: block storage bills on provisioned capacity (regardless of used bytes), object storage bills on stored bytes plus requests and egress.

A private network is a tenant-scoped L2/L3 segment; servers on the same segment communicate by private IP without traversing the internet.

Subnets carve the private network into IP ranges; the CIDR must not overlap with networks reachable over VPN, or routing will fail.

A load balancer fronts one or more backend servers and health-checks them; unhealthy backends are removed from rotation automatically.

Listener protocol (HTTP/HTTPS/TCP) determines whether the balancer can inspect and route on L7 attributes or only forward L4 connections.

DNS service maps zone records (A, AAAA, CNAME, MX, TXT) to IPs or hostnames; record TTL controls how long resolvers cache, so lower TTL speeds failover.

VPN gateway connects the private network to an on-premises or other cloud network over IPsec; the peer's allowed CIDRs and pre-shared key must match on both sides.

Public IP assignment is a separate step from private IP; releasing a reserved public IP returns it to the pool and breaks any DNS record pointing at it.

Troubleshooting order: security group/packet filter rules, then route table/subnet association, then listener health check, then DNS resolution.

Authentication proves identity (account credentials, API key, SSH key); authorization decides which API actions are permitted on which resources.

Least privilege rule: grant the narrowest action set on the narrowest resource scope, and use separate identities per workload rather than one shared key.

API keys/secrets are bearer credentials: anyone holding them has the granted permissions, so rotate them and never embed them in source or images.

Network-layer control uses firewall/packet-filter rules on the server's interface; default-deny inbound with explicit allow rules is the safe baseline.

TLS termination at the load balancer offloads encryption and centralizes certificate management; traffic from balancer to backend may then be plaintext unless re-encrypted.

Audit trail: API operation logs record who called which action and when; they are the primary evidence for investigating unauthorized changes.

Key management rule: private keys stay client-side; the service stores the public key only, so a lost private key cannot be recovered from the cloud side.

Segmentation rule: place internet-facing servers in one segment and databases in another, allowing only the specific ports required between them.

Monitoring collects metrics at a sampling interval; a metric is a time series of (namespace, metric name, dimensions) and alarms evaluate thresholds over periods.

Alarm evaluation: threshold + comparison + consecutive periods; too short a period causes flapping, too long delays detection - set periods from the metric's natural cycle.

Common host metrics: CPU utilization, disk read/write, network in/out, and disk usage; disk-full is not visible from hypervisor metrics without a guest agent.

Logs and metrics are complementary: metrics detect that something changed, logs explain why; alert on metrics, investigate with logs.

Billing is metered per resource-hour or per provisioned unit; stopped servers still bill for attached disks, and released resources stop billing at release time.

Cost control levers: delete unattached disks and unused public IPs, right-size server types to actual utilization, and apply lifecycle rules to object storage.

Change management rule: snapshot/image before a type change or OS patch so rollback is a restore, not a rebuild.

Tagging discipline: assign owner and environment tags at creation; untagged resources cannot be attributed to a cost center in billing reports.