RepetoWhich AWS observability service collects metrics and logs and supports alarms and dashboards?
Amazon CloudWatch.
Cloud fundamentals
240 questions in English on cloud services, security and cost, with AWS, Azure and Google Cloud examples. 2026 edition.
- 240 cards
- By Repeto
- Free
What the cards look like
Who is responsible for protecting the customer's cloud account credentials?
The customer, using the identity controls provided by the platform.
What does resource pooling mean in the NIST cloud model?
A provider shares a resource pool among consumers and assigns capacity as demand changes.
Which AWS service provides a logically isolated virtual network for cloud resources?
Amazon Virtual Private Cloud, or Amazon VPC.
Why separate everyday access from highly privileged administration?
It limits the authority exposed during routine work and reduces the impact of mistakes or compromise.
What is the central idea of a blue-green deployment?
Keep separate old and new environments, then switch traffic to the validated new environment.
All 240 cards
Every card in the deck, in study order.
Question Answer
Which AWS observability service collects metrics and logs and supports alarms and dashboards? Amazon CloudWatch.
Who is responsible for protecting the customer's cloud account credentials? The customer, using the identity controls provided by the platform.
What does resource pooling mean in the NIST cloud model? A provider shares a resource pool among consumers and assigns capacity as demand changes.
Which AWS service provides a logically isolated virtual network for cloud resources? Amazon Virtual Private Cloud, or Amazon VPC.
Why separate everyday access from highly privileged administration? It limits the authority exposed during routine work and reduces the impact of mistakes or compromise.
What is the central idea of a blue-green deployment? Keep separate old and new environments, then switch traffic to the validated new environment.
Why delay repeated retries with increasing backoff after transient failures? To reduce pressure on a struggling dependency while allowing time for recovery.
Why does a cache need an expiration or invalidation strategy? Cached values can become outdated when the underlying data changes.
Which Google Cloud service stores object data in buckets? Cloud Storage.
How can consistent ownership tags or labels help cost management? They support assigning resource costs to responsible teams, products, or projects.
What does the recovery point objective, or RPO, specify? The maximum acceptable data-loss interval, measured backward from a disruption to the recoverable data point.
What does a virtual-machine image supply when creating an instance? A reusable starting template containing an operating system and possibly installed software.
What makes an operational alert actionable? It identifies a condition that needs a defined response, with enough context for the responder to act.
Does a budget notification alone enforce a hard spending cap? No. A notification reports a threshold; stopping or limiting spending requires separate controls.
Why acknowledge a message only after its processing has succeeded when using manual acknowledgments? So the broker does not complete the delivery before the required work has succeeded.
What does function concurrency measure? The number of function executions being handled at the same time.
What is the purpose of an object retention lock? To restrict deletion or overwrite for a retention period under the selected lock rules.
Why can an unused provisioned resource still incur charges? Some charges depend on allocated capacity or retained storage rather than active application work.
What is failback after a disaster-recovery failover? Returning operation to the preferred environment after it is ready, while handling data synchronization and traffic safely.
Which Google Cloud managed application platform can run containers without the customer managing execution servers? Cloud Run.
What distinguishes an active-active deployment from active-passive? Multiple sites or components serve production work simultaneously; an active-passive alternate does not serve that production traffic until failover.
What does saturation indicate when monitoring a resource? How close it is to a capacity limit, such as a full queue or exhausted CPU capacity.
What is vertical scaling of a virtual machine? Changing the capacity of one VM, such as its CPU or memory allocation.
What does point-in-time database recovery allow when supported and configured? Restoring data to a selected time within the available recovery window.
What cost risk comes with a fixed usage or spending commitment? Paying for committed capacity or spend that the workload no longer needs.
What is the basic storage unit of a document database? A document containing fields and values, often with nested structures.
What is failover? Moving service operation to an alternate component or location after the active one becomes unavailable.
What is a Pod in Kubernetes? The smallest deployable unit: one or more co-scheduled containers sharing networking and specified storage.
What is the primary job of a load balancer? To distribute incoming traffic among backend targets according to its routing policy.
What does a DNS record's TTL control for ordinary caching? How long a cached answer is normally considered fresh before it needs revalidation.
What does TLS protect for an established connection? The confidentiality and integrity of data exchanged between its endpoints.
Which AWS service stores objects in buckets? Amazon Simple Storage Service, or Amazon S3.
What is a failure domain in a cloud architecture? A set of components that can be affected by the same failure, such as loss of one power supply or location.
What happens on a cache miss in the cache-aside pattern? The application reads from the underlying store and can place the result in the cache.
What is a function handler in event-driven compute? The application entry point that receives and processes an invocation's event.
Why can overlapping private address ranges complicate connecting two networks? The same destination address can refer to different hosts, making direct routing ambiguous.
Which Google Cloud service collects and analyzes metric data for application and service health? Cloud Monitoring.
Why should an instance finish or hand off work before autoscaling removes it? Abrupt removal can interrupt requests or lose unfinished work.
What makes a deployment a hybrid cloud in NIST's definition? Distinct cloud infrastructures remain separate but are connected to enable data or application portability.
Why route repeatedly failing messages to a dead-letter queue? To isolate them for investigation or controlled reprocessing instead of repeatedly blocking normal processing.
Which AWS managed NoSQL database supports key-value and document data models? Amazon DynamoDB.
What can happen if the only usable key for encrypted backups is permanently lost? The backups may become unreadable even if their stored bytes remain intact.
Which Azure storage service is designed for object data such as images and documents? Azure Blob Storage.
What does a customer primarily consume in SaaS? A provider-operated application, with limited customer configuration.
Which AWS service provides managed Kubernetes clusters? Amazon Elastic Kubernetes Service, or Amazon EKS.
Why does storage encryption not replace access control? An authorized read path may decrypt data, so permissions must still limit who can use that path.
What does DNS let a client look up for a domain name? Resource records, such as addresses used to contact the named service.
What operating-system component do ordinary containers on the same host share? The host kernel, unlike separate VMs with their own guest kernels.
Which Azure service supplies a virtual network for connecting cloud resources? Azure Virtual Network, also called VNet.
What does a site-to-site IPsec VPN connect? Two networks through encrypted tunnels, such as an office network and a cloud network.
How does storage throughput differ from IOPS? Throughput measures bytes transferred per second; IOPS counts operations per second.
Why can a deployment across zones in one region still need a regional recovery plan? A region-wide disruption can affect all those zones or a shared regional dependency.
Which Azure service provides managed Kubernetes clusters? Azure Kubernetes Service, or AKS.
How does a synchronous request differ from submitting asynchronous work to a queue? The caller waits for the operation's response rather than just handing off work for later processing.
What does a steadily growing queue backlog suggest when arrivals exceed completions? Consumers are not keeping up with incoming work.
What does IOPS measure for storage? The number of input/output operations completed per second.
What does the IPv4 route prefix 0.0.0.0/0 represent? A default route that can match any IPv4 destination when no more specific route takes precedence.
Why consider user location when selecting a cloud region? Longer network paths can add latency; nearby placement may reduce it.
Why is continuously replicated data not necessarily a sufficient backup? Replication can copy deletion or corruption; a recoverable earlier version may still be needed.
Why might a newly changed origin file require cache expiration or invalidation before all users see it? Edge caches can keep serving the previously cached version.
Show the other 180 cards
What distinguishes a private cloud from a public cloud in NIST's deployment models? A private cloud is for one organization; a public cloud is offered for general public use.
Why test failover instead of relying only on a design diagram? A test can reveal missing capacity, configuration, access, or dependencies in the recovery path.
Which Azure service provides managed block-storage volumes for Azure virtual machines? Azure Managed Disks.
Why must a cloud resource's geographic scope be checked in its service documentation? Resources may be zonal, regional, or global; the scope affects placement and failure assumptions.
Why should a WAF not replace fixing a known application vulnerability? Filtering can reduce exposure, but it does not remove the defect from the application.
Why restrict access to infrastructure state files? They can contain sensitive resource attributes, including credentials or other secrets.
How does an object-storage API commonly identify stored data? By an object name or key within a bucket or container.
Which AWS content delivery service serves content through a network of edge locations? Amazon CloudFront.
What does a DNS AAAA record contain? An IPv6 address.
Why is an archive storage class not automatically suitable for frequently accessed data? Retrieval delay, retrieval charges, or minimum retention terms can conflict with the workload's access pattern.
Why does storing a user's only session copy on one application instance complicate scale-out? Requests sent to another instance may lack that session state.
What association does Terraform state maintain? The mapping between declared resource instances and the real objects Terraform manages.
Why compare operational effort as well as resource charges when choosing a managed service? Administration, maintenance, and support effort also affect the total cost of running the workload.
What does a distributed trace show? The path and timing of a request as it passes through operations across services.
Why is a provider's secure infrastructure insufficient to establish that a workload is secure? Customer code, permissions, and configuration can still introduce vulnerabilities.
Why distribute redundant application instances across isolated zones? To reduce the chance that one location failure removes every instance.
How does role-based access control simplify permission management? Permissions are grouped into roles that can be assigned to identities at a defined scope.
What does graceful degradation aim to preserve during a partial failure? Useful core functionality while less critical features are reduced or unavailable.
What does an object-storage lifecycle policy automate? Transitions between storage classes or deletion when configured conditions are met.
What does measured service mean in cloud computing? Resource use is metered so usage can be monitored, controlled, and reported.
Which Azure observability service analyzes telemetry such as metrics, logs, and traces? Azure Monitor.
How many bits are in an IPv4 address? 32 bits.
Which AWS service offers Event Functions that run code in response to events without provisioning execution servers? AWS Lambda.
Why can rolling back application code fail to undo a bad database migration? The migration may have changed or removed data that the previous code cannot reconstruct.
What does partitioning data across database shards accomplish? It divides data among storage or processing units so work need not remain on one unit.
What is horizontal scaling of an application tier? Adding or removing instances that share the workload.
Which Google Cloud content delivery service uses edge caches with supported external Application Load Balancers? Cloud CDN.
What is object metadata? Descriptive attributes stored with an object, such as content type or custom labels.
What distinguishes an SLA from an internal SLO? An SLA is an agreement with specified consequences if agreed service levels are not met.
In a queue with a visibility timeout, what happens if processing is not completed before the timeout expires? The message can become available for another processing attempt.
Does adding capacity by itself establish high availability? No. Added instances may still share a failure domain or depend on one failing component.
What is a log record in application observability? A recorded event with contextual information, usually including a timestamp.
How does an audit log help investigate a cloud configuration change? It can record the actor, action, time, and affected resource.
If routes for 10.0.0.0/8 and 10.2.0.0/16 both match a destination, which prefix is more specific? 10.2.0.0/16, because it matches more destination-address bits.
Which Google Cloud managed NoSQL document database stores data in documents and collections in Native mode? Firestore in Native mode.
How can object versioning help after an accidental overwrite? It can preserve an older version that can be restored, subject to retention and deletion settings.
In a hypothetical model charging 2 credits per instance-hour, what do 3 instances running for 5 hours cost? 30 credits: 3 × 5 × 2, excluding all other charges.
What does encryption at rest protect? The confidentiality of stored data when someone lacks the required decryption key or access.
What exposure does an expiration time reduce for temporary credentials? The period during which a stolen credential can be reused without renewal.
Why reference a container image by digest when exact content matters? A digest identifies image content; a mutable tag can later point to different content.
Which Google Cloud service provides managed Kubernetes? Google Kubernetes Engine, or GKE.
Why distinguish a subnet's total address count from usable cloud host addresses? Providers reserve addresses differently, so the prefix alone does not establish the allocatable host count.
Which Azure service runs configurable virtual machines with customer-managed guest operating systems? Azure Virtual Machines.
What is the purpose of an edge location in a content delivery network? To serve or process requests closer to users than a distant origin.
Why might doubling web-server instances fail to double application throughput? A shared bottleneck, such as a database, may still limit the whole application.
What does cloud elasticity describe? The ability to add and release resources as demand changes.
How many total IPv4 addresses are in a /24 block before any reserved-address rules? 256 addresses: 2 to the power of 8.
What does the /24 in an IPv4 CIDR prefix mean? The first 24 bits identify the network prefix, leaving 8 address bits within that block.
What is a container image used for? Packaging the application and its runtime dependencies so containers can be created consistently.
Why is attaching one block device to multiple writers not enough to create a safe shared filesystem? The filesystem and applications must coordinate concurrent access; ordinary local filesystems may not do so.
Which three IPv4 blocks does RFC 1918 reserve for private networks? 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.
Does serverless computing mean that no servers execute the code? No. Servers still execute it; the platform manages the underlying execution infrastructure.
What is the role of a container registry? Storing and distributing container images.
What does least privilege mean when granting cloud access? Grant only the permissions needed for the required task and scope.
If a system's RPO is 15 minutes, what data-loss window is the recovery design intended to limit? At most 15 minutes of data, measured in time before the disruption.
Why must a TLS client validate the server's identity as well as establish encryption? Otherwise it may establish an encrypted connection to an impostor.
Who shares a community cloud in NIST's deployment models? Organizations with common concerns, such as shared security or mission requirements.
How many equal /26 blocks fit inside one IPv4 /24 block? Four /26 blocks.
Why should a team review shared responsibility for each service it adopts? The division of duties changes with the service and its configuration.
Which Azure service provides a global edge platform for accelerating and delivering web applications and content? Azure Front Door.
Why keep required durable state outside a serverless execution environment? The platform can replace or retire that environment, so its local state is not a durable system of record.
What is the main purpose of a read replica used for scaling? Serving read queries on another copy so the primary handles less read load.
What does a network firewall primarily evaluate when filtering packets or connections? Network attributes such as source, destination, protocol, and port, according to its rules.
What does shared responsibility allocate between a cloud provider and a customer? Duties for securing and operating the service and the customer's workload.
Why check filesystem semantics before replacing a file share with object storage? Object APIs and file interfaces can differ in operations, locking, and update behavior.
Which AWS service provides configurable virtual-machine instances? Amazon Elastic Compute Cloud, or Amazon EC2.
What does rightsizing a cloud resource aim to do? Match capacity to measured workload needs while retaining required performance and reliability.
What is a virtual machine? A software-defined computer that runs its own guest operating system on virtualized hardware.
What does defense in depth mean for a cloud workload? Using multiple protective controls so that failure of one control does not remove every safeguard.
How does a work queue decouple a producer from a consumer? The producer submits work to a buffer that consumers process separately.
What must be checked before choosing a region for a specific cloud service? Whether the required service, features, and resource types are available there.
What access pattern is central to a key-value database? Looking up a value using its unique key.
What is envelope encryption? Encrypting data with a data key, then encrypting that data key with a separate key-encryption key.
Why separate backup deletion authority from ordinary application write access? A compromised application identity should not automatically be able to erase every recovery copy.
In Google Cloud VPC, what is the scope of a VPC network compared with its subnets? The VPC network is global; its subnets are regional.
Why limit function concurrency when calling a capacity-limited database? Unbounded parallel requests can overwhelm the database even if compute can scale further.
What is a metric in application observability? A numeric measurement collected over time, such as request count or memory use.
Why use a Kubernetes Service in front of replaceable application Pods? It provides a stable way to reach a changing set of backend Pods.
Why might a database need coordination before taking a storage snapshot? To capture a recoverable application state rather than unrelated points in ongoing writes.
What does atomicity guarantee for a database transaction? Its changes commit together or are rolled back together.
Which Google Cloud block-storage option provides persistent disks for supported Compute Engine instances? Persistent Disk; availability depends on the chosen machine series.
Why configure a load balancer's health checks to reflect application readiness? A process can be running while unable to serve useful requests.
How does block storage present data to a connected machine? As addressable blocks, typically used as a disk on which software creates a filesystem or database layout.
What does the recovery time objective, or RTO, specify? The targeted maximum time to restore the required service after a disruption.
What does on-demand self-service mean in cloud computing? A customer can provision computing resources without a provider employee handling each request.
What does identity federation allow in cloud access? An external identity provider's authentication to be trusted by the cloud service under a configured relationship.
Why examine a high latency percentile as well as average latency? An average can hide the much slower responses experienced by a minority of requests.
Why can two instances on the same host provide less isolation than two instances on separate hosts? A host failure can stop both instances at once.
What does ephemeral storage imply for data-retention planning? Data may disappear with the resource or execution environment's lifecycle, so it is unsuitable as the only durable copy.
What does declarative infrastructure configuration describe? The desired resource state rather than every manual step used to reach it.
How does a relational database organize its primary data model? In tables made up of rows and columns.
What is an event trigger in a function-based application? A configured event, such as a message or HTTP request, that starts function execution.
How can a cloud quota affect an autoscaling policy? The policy may be unable to add resources after the relevant quota is reached.
What does a Kubernetes readiness probe determine? Whether a container is ready to receive traffic through Services that select its Pod.
Why can a volume have enough free space but still limit application performance? Its IOPS, throughput, or latency characteristics may not meet the workload's needs.
Does a managed platform remove the customer's responsibility for application access permissions? No. The customer still determines and configures appropriate access to its application and data.
Does an RFC 1918 address provide globally routable public Internet addressing? No. It is intended for private networks and is not globally unique.
Which Azure managed NoSQL database service supports globally distributed applications? Azure Cosmos DB.
What does storage durability describe? The ability to retain stored data without loss over time.
What is the purpose of network segmentation? To divide a network into controlled areas and limit which traffic can cross between them.
For a self-managed IaaS virtual machine, who patches the guest operating system? The customer operating the VM.
What does a DNS CNAME record express? That one domain name is an alias for another domain name.
What does a routing table determine? The next hop or forwarding target for traffic matching a destination prefix.
Which Google Cloud service offers self-managed virtual-machine instances? Compute Engine.
What must a consumer tolerate under an at-least-once delivery guarantee? Receiving the same logical message more than once.
Why give an application its own workload identity instead of a person's credentials? Its permissions and lifecycle can be managed independently of that person's account.
Which Azure serverless service executes function code in response to triggers such as HTTP requests and queue messages? Azure Functions.
What does a DNS A record contain? An IPv4 address.
What does rotating an application secret involve? Replacing the secret and updating its consumers so they use the new valid value.
Why make a handler idempotent when events can be delivered more than once? Repeated processing should not repeat the intended business effect, such as charging twice.
What does a cloud region identify at a high level? A geographic area in which a provider offers resources; its exact boundaries and service scope are provider-defined.
What does a Kubernetes Deployment controller reconcile? The running workload toward the desired Pod configuration and replica count.
What does an IaaS customer manage above the provider's infrastructure? The guest operating system, applications, and data, plus customer-controlled networking settings.
What distinguishes multi-factor authentication from using two passwords? It combines different kinds of factors, rather than multiple secrets of the same factor type.
What distinguishes publish-subscribe from a work queue with competing consumers? Publish-subscribe can deliver an event to multiple subscriptions; competing consumers share work from one queue.
Why put important container data on suitable persistent storage rather than only in the container's writable layer? The writable layer is tied to the container and does not provide durable storage across container replacement.
What does an availability objective describe? The target level of successful service access over a defined measurement period.
Does selecting a region alone establish where every copy of application data resides? No. Backup, replication, logging, and service-specific data-location settings also need review.
What does a cold start mean in a serverless execution environment? Initialization needed before a newly prepared execution environment can handle a request.
What is a service level indicator, or SLI? A precisely defined measurement of service behavior, such as the fraction of successful requests.
What is a key-management service used to control? Creation, protection, access, and lifecycle operations for cryptographic keys.
What does storage I/O latency measure? The elapsed time for an individual read or write operation to complete.
Which AWS service supplies persistent block-storage volumes for EC2 instances? Amazon Elastic Block Store, or Amazon EBS.
Which Azure PaaS offering provides a managed database based on the SQL Server engine? Azure SQL Database.
Why include a shared trace identifier across related service operations? To connect those operations into one request's execution path.
What does a container orchestrator coordinate? Deployment, placement, and ongoing operation of containerized workloads across available compute resources.
In a provider-hosted public cloud, who normally secures the provider's physical data-center infrastructure? The cloud provider.
Why review an infrastructure tool's change plan before applying it? To inspect intended creations, modifications, and deletions before they affect resources.
What does PaaS let a developer deploy without managing the underlying operating system? Applications using the platform's supported runtimes and services.
What does a successful backup job alone fail to prove? That the saved data and required dependencies can actually be restored into a usable service.
Why might a read from an asynchronous replica omit a recent committed write? The replica may not yet have applied that write.
What is a CDN cache hit? A request satisfied from a cached copy at the edge rather than fetching that content from the origin.
What problem can a private endpoint solve for a cloud service? It can provide access using private network addressing instead of exposing the service connection directly to the public Internet.
Why can a correctly routed packet still fail to reach an application? Firewalls, network policies, or the application listener can still reject or fail to accept it.
What does storage availability describe? Whether data can be accessed when requested; data can remain durable during a temporary access outage.
Does outbound NAT automatically let Internet hosts initiate connections to private instances? No. Ordinary outbound NAT supports replies to initiated connections, not arbitrary unsolicited inbound connections.
In a simple usage-based charge, what two quantities determine the charge? Billable usage multiplied by the applicable unit rate.
What is a single point of failure? A component whose failure alone can stop the required service.
What does a time-limited signed object URL provide? Permission to perform specified object operations for a limited period without making the object generally public.
Why must disaster recovery cover more than application data? The service also needs deployable code, configuration, access, and infrastructure to run again.
Why review an object bucket's access policy before storing sensitive data? A permissive policy can expose data even when the underlying storage service is secure.
Why periodically review granted permissions? Roles, workloads, and staff change, leaving permissions that are no longer needed.
At a hypothetical rate of 4 credits per GB-month, what does 25 GB stored for one full month cost? 100 credits: 25 × 4, excluding all other charges.
What does redundancy add to a system? Additional components or copies that can support operation when a component fails.
Which Google Cloud service manages relational databases using MySQL, PostgreSQL, or SQL Server? Cloud SQL.
Does using serverless compute eliminate responsibility for vulnerabilities in application dependencies? No. The customer remains responsible for the application code and dependencies it supplies.
What drives a metric-based autoscaling policy? A measured signal, such as CPU use or queue backlog, evaluated against a configured policy.
What server-management task does serverless compute typically abstract from the application developer? Provisioning and maintaining the underlying execution servers.
What is configuration drift in infrastructure management? A difference between the intended configuration and the actual deployed resource state.
What defines symmetric encryption? The same secret key is used to encrypt and decrypt data.
How many total IPv4 addresses are in a /26 block before any reserved-address rules? 64 addresses: 2 to the power of 6.
What does a canary deployment expose first? A limited share of real traffic or users to a new version before wider rollout.
Why check execution limits before moving a task to a serverless service? Limits on runtime, resources, and supported execution models can determine whether the task fits that service.
What security property does a denial-of-service attack primarily threaten? Availability, by exhausting resources or disrupting access.
What is the purpose of an incident-response runbook? To document actions, responsibilities, and escalation paths for handling a defined class of security incident.
What should a secret store hold that ordinary application configuration should not expose? Sensitive values such as database passwords, API credentials, and tokens.
What does a backup retention policy determine? How long recovery copies are kept before they expire or are removed.
What does a storage snapshot capture? A point-in-time view of stored data that can be used to create or restore a volume.
Why consider dependencies when evaluating an application's availability? The application may fail even when its own servers run if an essential dependency is unavailable.
Which AWS service manages common administration tasks for supported relational database engines? Amazon Relational Database Service, or Amazon RDS.
Why might clients still use an old address immediately after a DNS record changes? Resolvers or clients may still have the previous answer cached.
Why include data movement when estimating a cloud workload's cost? Transfer charges can depend on the path, destination, and service, in addition to compute and storage.
What does a circuit breaker do after detecting repeated dependency failures? It temporarily stops calls to that dependency, allowing failure handling without continuously adding load.
What interface does network file storage provide to applications? Shared files and directories accessed through a file protocol such as NFS or SMB.
What tradeoff does adding a database index introduce? It can accelerate relevant reads but consumes storage and adds maintenance work to writes.
Who determines the sensitivity classification of data placed in a cloud service? The customer responsible for that data.
What is a rolling application deployment? Replacing instances in stages while other instances continue serving traffic.
What type of traffic does a web application firewall inspect for application-layer attacks? Web requests, such as HTTP requests containing suspicious input.
What is a service level objective, or SLO? A target for an SLI over a specified time window.
Can an application assume that every queue delivers messages in the order sent? No. Ordering guarantees depend on the queue type and configuration.
Is 10.20.4.70 inside the IPv4 subnet 10.20.4.64/26? Yes. That block spans 10.20.4.64 through 10.20.4.127.
What question does authorization answer? Whether that identity is permitted to perform the requested action on the resource.
Does being inside a private network automatically make a request trustworthy in zero trust? No. Access decisions should evaluate identity and policy rather than assume trust from network location.
What is infrastructure as code? Managing infrastructure through machine-readable definitions that can be versioned and applied by tools.
How does a route differ from a firewall rule? A route selects a path; a firewall rule controls whether traffic is permitted.
What does a vulnerability scan provide? Findings about potential weaknesses in the scanned components; remediation still requires action.
What does source NAT change on outgoing packets? The source address, and often the source port, so replies can be mapped back to the originating host.
When a managed database service patches its engine, does it also decide which users should access the customer's data? No. Database maintenance and customer access policy are separate responsibilities.
What workload property helps it tolerate interruptible compute capacity? The ability to restart, retry, or resume from checkpoints after an instance is reclaimed.
What question does authentication answer? Which identity is making the request.
How you study it in Repeto
- Install the deck free. It lands in your library on the web, iPhone, iPad and Mac.
- Answer from memory. See the front, recall the answer, then flip and rate how it went.
- Review at the right time. FSRS spaced repetition brings each card back just before you would forget it, so a few minutes a day is enough.
Sources and license
Original Repeto study-card text. Educational diagrams and museum images retain the source, creator and license attribution recorded on each card and in the documented source manifest.