NIFCLOUD Certified Associate key terms

An isolated fault domain inside a NIFCLOUD region, with its own power and network infrastructure. You choose a zone when launching a server, and spreading resources across zones improves resilience.

A geographic area containing multiple independent zones where NIFCLOUD services and resources are provisioned. Resources generally do not span regions automatically, so architects select a region close to users and replicate across regions when needed.

An architecture that distributes instances and data across two or more zones in one region so a single zone failure does not stop the service. It typically pairs with load balancing and replicated storage.

A resizable compute instance running an operating system image on NIFCLOUD infrastructure. You select a type, zone, image, disk, and network attachment, then manage it much like a physical server over SSH or RDP.

A predefined hardware profile that sets a virtual server's CPU and memory allocation, such as a general-purpose or memory-optimized family. Changing type usually requires stopping the instance and may change billing.

A template containing an operating system and optional preinstalled software used to create virtual servers. NIFCLOUD offers official images and lets you capture your own from an existing server for repeatable deployments.

A private image you create from a configured server so new instances start with the same OS, packages, and settings. It supports autoscaling and disaster recovery but should be refreshed after patching.

A policy-driven service that adds or removes virtual servers based on metrics such as CPU load or a schedule. It relies on a launch template, minimum and maximum sizes, and health checks.

Increasing or decreasing a single server's CPU and memory by changing its server type. It is simple but usually needs downtime and has an upper limit, unlike horizontal scaling with more instances.

Network-attached disk volumes presented to a virtual server as raw devices that you format with a filesystem. Volumes persist independently of the instance lifecycle and can be detached and reattached.

A point-in-time copy of a disk volume stored durably and used to restore data or create new volumes. Snapshots are incremental in nature and are the basis of backup and cloning workflows.

A flat namespace service that stores data as objects inside buckets, accessed over HTTP APIs rather than as a mounted disk. It suits static content, backups, and logs where scale matters more than low-latency block access.

A named container in object storage that holds objects and defines their namespace, access policy, and location. Bucket names must be globally unique within the service and are chosen at creation time.

A low-cost storage class for rarely accessed data with slow retrieval, often minutes to hours. It is appropriate for compliance records and long-term backups, not for data needed on demand.

An automated policy that transitions objects between storage classes or deletes them after a set age. It controls cost by moving stale data to archive tiers without manual intervention.

A logically isolated virtual network segment where you define an address range and attach servers so they communicate privately. It can be interconnected with other networks through gateways and peering.

A contiguous range of IP addresses carved from a private network, tied to a zone and used to place servers. Routing and firewall rules are often applied per subnet.

A set of rules deciding where traffic from a subnet is sent, such as to a local network, internet gateway, or VPN. The most specific matching route wins, so ordering and prefix length matter.

A managed service that distributes incoming requests across multiple backend servers and removes unhealthy ones from rotation. It supports listeners, health checks, and TLS termination for resilient web tiers.

A periodic probe that tests whether a backend server responds correctly, using a protocol, port, path, and timing thresholds. Consecutive failures mark a target unhealthy so traffic stops reaching it.

A managed container for records of a domain, such as address, alias, and mail records, served by authoritative name servers. Delegation from the registrar points the domain at the zone's name servers.

An individual DNS entry inside a zone mapping a name and type to a value, for example an address record pointing a hostname to an IP. Multiple values can be returned for simple load distribution.

Time to live, the number of seconds a DNS resolver may cache a record before querying again. Short values speed up changes but raise query volume; long values reduce load but slow propagation.

A lookup that maps an IP address back to a hostname, commonly used by mail servers to validate senders. It requires a pointer record configured for the address in the appropriate zone.

A managed endpoint that terminates encrypted tunnels between your private network and an on-premises or other cloud network. It pairs with routing and firewall rules to control which traffic crosses the tunnel.

A named set of inbound and outbound rules attached to servers that permits or denies traffic by protocol, port, and source. Rules are stateful in practice, so return traffic for allowed sessions is accepted.

A JSON-style document granting or denying specific actions on specific resources to a principal. Policies attach to users, groups, or roles, and evaluation combines all applicable statements.

An identity with permissions that trusted entities such as servers or users can assume temporarily instead of holding long-lived keys. Assumption returns short-lived credentials, reducing secret sprawl.

A credential pair of an identifier and secret used for programmatic API authentication. Secrets must be stored securely and rotated, since leaked keys allow actions allowed by the attached policy.

The practice of granting only the permissions needed for a task and nothing more. It limits blast radius if credentials leak and is implemented through narrow policies, roles, and regular review.

Requiring a second proof of identity beyond a password, such as a one-time code from an app or hardware token. It protects console and API access even when a password is compromised.

A numeric time series such as CPU utilization or disk throughput collected automatically from resources. Metrics drive dashboards, alarms, and autoscaling decisions, and are retained for a limited period.

A rule that watches a metric against a threshold for a number of periods and triggers notifications or actions when breached. Alarms are the primary way to detect degradation without watching dashboards.

A configured delivery channel, such as email or a webhook, that receives alarm state changes and operational events. It connects monitoring to the people or automation that must respond.

A chronological record of API calls and configuration changes showing who did what and when. It supports troubleshooting, compliance evidence, and security investigations after an incident.

A schedule defining which volumes or resources are copied, how often, and how long copies are kept. It automates recovery points and should be paired with periodic restore testing.

A threshold on forecast or actual spend that sends a warning before costs exceed budget. It catches runaway autoscaling or forgotten resources and complements per-resource cost review.

A key-value label attached to resources for organization, automation, and cost allocation. Consistent tagging lets you filter inventory, attribute bills to teams, and apply policy by environment.