NIFCLOUD Certified Associate flashcards
NIFCLOUD Certified Associate · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- NIFCLOUD
- A Japanese public cloud platform operated by Fujitsu, offering virtual servers, block and object storage, private networking, load balancing, DNS, and VPN as separately managed services through a console and APIs.
- Region and zone
- A region is a geographic service area containing multiple zones; each zone is an isolated failure domain with independent power and network, so distributing servers across zones reduces the impact of a single zone failure.
- API key
- A bearer credential used to authenticate programmatic requests to the NIFCLOUD API instead of console login. Anyone holding the key inherits its permissions, so it must be rotated and never committed to source code.
- Resource tagging
- Free-form key/value metadata attached to resources. Tags are the primary mechanism for grouping resources by owner, environment, or cost center so billing reports and operational filters can attribute spend.
- Virtual server definition
- A virtual server is defined by its OS image, server type specifying CPU and memory, attached disks, network interfaces, and zone placement. Changing CPU or memory requires a server type change.
- Server type change
- Resizing a virtual server's CPU or memory is done by switching its server type, which normally requires stopping the server first. The existing disk and its data are retained across the change.
- Custom image
- A boot template captured from an existing server's disk, preserving the installed OS and software. Images are scoped to a region or zone, so cross-region reuse requires copying the image first.
- Stopped server billing
- A stopped virtual server does not bill for compute time, but its attached block disks continue to bill because the disk is a separate resource that still holds provisioned capacity.
- Key pair login
- At creation you supply an SSH public key or set an administrator password. The private key never leaves the client, so if it is lost the cloud cannot recover it and access requires disk reattachment or rebuild.
- Private versus public IP
- Every server receives a private IP on its attached network segment. Internet reachability is not automatic; it requires separately assigning a public or global IP or fronting the server with a load balancer.
- Server flavor sizing rule
- Size for peak memory first, then vCPU. Undersized memory causes out-of-memory kills inside the guest that appear as application crashes rather than obvious infrastructure faults, making diagnosis slow.
- Block storage characteristics
- Block disks attach to one virtual server at a time and are bound to a zone. They persist independently of the server, so deleting a server does not automatically delete or stop billing for its disks.
- Disk expansion limits
- Block disks can be enlarged but not shrunk. After the cloud-side expansion, the guest operating system must grow its partition and filesystem to actually use the additional capacity.
- Object storage
- A bucket-based store where objects are addressed by key and accessed over HTTP APIs. It suits static content, backups, and logs, and cannot be attached as a boot volume for a server.
- Object versioning
- A bucket setting that retains prior copies of an object when it is overwritten or deleted. It protects against accidental overwrite and ransomware but increases stored bytes and therefore cost.
- Lifecycle rules
- Bucket policies that automatically transition or expire objects after a defined age. They cap unbounded storage growth and move aging data toward cheaper tiers without manual intervention.
- Archive storage
- A low-cost tier for long-term retention where retrieval is not immediate and may be queued and billed separately. It suits compliance archives, not data needed for active serving.
- Storage cost drivers
- Block storage bills on provisioned capacity regardless of bytes actually written. Object storage bills on stored bytes plus request counts and outbound data transfer, so egress can dominate.
- Private network
- A tenant-scoped network segment where attached servers communicate using private IP addresses without traversing the internet. Subnets divide it into ranges that must not overlap with VPN-reachable networks.
- Subnet CIDR overlap
- If a subnet range overlaps an address range reachable through a VPN or interconnection, routing becomes ambiguous and traffic fails. Plan address space globally before creating subnets.
- Load balancer health check
- A periodic probe of each backend server. Backends that fail the check are removed from rotation automatically and restored when they pass again, which is the basis of automatic failover.
- Listener protocol choice
- The listener protocol determines capability: HTTP or HTTPS listeners can inspect requests and route on layer 7 attributes, while TCP listeners only forward layer 4 connections without inspecting content.
- DNS record TTL
- Time to live, in seconds, that resolvers cache a record. A low TTL shortens the window during which clients reach a stale address after failover, at the cost of more queries.
- VPN gateway
- An IPsec endpoint connecting a private network to an on-premises or other cloud network. Both peers must agree on the pre-shared key and on the allowed CIDR ranges for traffic to pass.
- Network troubleshooting order
- Check packet filter and firewall rules first, then subnet and route table association, then load balancer health check status, and finally DNS resolution, since each layer can silently drop traffic.
- Authentication versus authorization
- Authentication establishes who is calling, using account credentials, an API key, or an SSH key. Authorization then determines which API actions that identity may perform on which specific resources.
- Least privilege
- Granting each identity only the actions it needs on the narrowest resource scope, with separate identities per workload. This limits the blast radius if one credential is leaked or misused.
- Packet filter baseline
- Inbound rules should default to deny with explicit allows for required ports only. Outbound rules should likewise be restricted so a compromised server cannot freely reach internal segments.
- TLS termination at balancer
- Decrypting HTTPS at the load balancer centralizes certificate management and offloads CPU from backends, but traffic from balancer to backend is plaintext unless re-encrypted inside the private network.
- API operation audit log
- A record of which identity called which API action on which resource and when. It is the primary evidence for investigating unauthorized configuration changes or credential misuse.
- Metric alarm evaluation
- An alarm compares a metric against a threshold over consecutive periods. Too short a period causes flapping from transient spikes; too long delays detection of real incidents.
- Metrics versus logs
- Metrics are numeric time series that reveal that something changed and trigger alarms; logs are detailed event records that explain why. Alert on metrics, then investigate using logs.