CompTIA Cloud Essentials+ (CLO-002) flashcards

A role required under GDPR for organizations that conduct large-scale or systematic processing of sensitive personal data, responsible for overseeing data protection compliance and liaising with regulators.

• Required for public authorities and large-scale sensitive data processors
• Acts as point of contact for data subjects and supervisory authorities
• Monitors GDPR compliance internally
• Must operate independently, reporting to top management

Memory trick: 'DPO = Data's Personal Officer' guarding privacy for regulators.

A security property ensuring that a party cannot deny having performed an action, such as sending a message or signing a document, typically enforced via digital signatures.

• Achieved through digital signatures using private keys
• Provides proof of origin and authenticity
• Complements confidentiality, integrity, and availability
• Important for contracts and legal/financial transactions

Memory trick: 'You signed it, you can't un-sign it' — non-repudiation locks in accountability.

Isolated physical locations within a cloud region, designed with independent infrastructure to minimize the risk of a single point of failure and enhance fault tolerance.

• Within a single geographic region
• Independent power, cooling, networking
• Used for high availability and disaster recovery

Memory trick: Think of a Region as a city, and Availability Zones as distinct neighborhoods within that city, each with its own utilities.

A cloud computing service model that provides ready-to-use applications over the internet, managed entirely by a third-party provider.

• Provider manages all layers: infrastructure, OS, applications, data.
• Users access via a web browser or API.
• Pay-as-you-go or subscription model for the application itself.

Memory trick: SaaS is software you just start to use.

A risk response strategy where the financial or operational impact of a risk is shifted to a third party, such as through insurance or contractual agreements.

• Does not reduce likelihood of the risk occurring
• Common examples: insurance, outsourcing, warranties
• One of four standard risk response strategies

Memory trick: A Man Takes Anything — Avoid, Mitigate, Transfer, Accept

A dedicated infrastructure layer for handling service-to-service communication in a microservices architecture, providing capabilities like traffic management, security, and observability.

• Manages traffic between microservices.
• Enforces policies (e.g., security, retry logic).
• Collects telemetry data (logs, metrics, traces).

Memory trick: Mesh connects services, making them secure and observed.

The physical or geographic location where an organization's data is stored, which may be dictated by business, contractual, or performance considerations rather than law.

• Distinct from data sovereignty (legal jurisdiction over data)
• Distinct from data localization (legal requirement to store data locally)
• Often specified in cloud service contracts or SLAs

Memory trick: Residency = where it lives by choice; Sovereignty = whose laws rule it; Localization = law forces it to stay.

A licensing model where software or service costs are directly tied to the actual usage of resources, such as CPU hours, data transfer, storage, or API calls, embodying the 'pay-as-you-go' principle of cloud computing.

• Pay-as-you-go model
• Charges based on actual resource usage
• Common in cloud computing for IaaS and PaaS
• Costs fluctuate with demand

Memory trick: License: Limit, Live, or Lease.

A cloud computing feature that automatically adjusts the number of computing resources in a group based on observed load or a schedule.

• Dynamically adds or removes instances.
• Ensures performance during peak loads.
• Optimizes costs by scaling down during low demand.

Memory trick: Auto-scaling is like a smart thermostat for your cloud, adjusting resources to match the 'temperature' of demand.

Under GDPR, consent is one of six lawful bases for processing personal data, requiring a freely given, specific, informed, and unambiguous opt-in, commonly required for marketing communications.

• Must be an affirmative opt-in, not a pre-checked box
• Individual can withdraw consent at any time
• Required for most direct marketing communications

Memory trick: CCLVPL: Consent, Contract, Legal obligation, Vital interests, Public task, Legitimate interests

Calculating the actual uptime percentage based on total time and recorded downtime within a service level agreement period.

• Total time = days * hours * minutes
• Uptime = total time - downtime
• Uptime % = (uptime / total time) * 100

Memory trick: To find uptime, first find total time, then subtract the minutes lost, then divide by total time for the percentage.

An access control model that assigns permissions to users based on their organizational role, rather than granting access individually.

• Simplifies administration by grouping permissions by job function
• Supports the principle of least privilege
• Common in healthcare, enterprise IAM systems

Memory trick: RBAC = 'Role Badges Assign Clearance'

A disaster recovery strategy where two or more sites are simultaneously active, processing requests and serving traffic, providing near-zero RTO and RPO.

• Both sites are fully operational.
• Traffic is distributed between sites.
• Offers highest availability and lowest RTO/RPO.

Memory trick: Faster recovery means more active, more replication.

A high availability and disaster recovery strategy where an application is deployed and actively serves traffic from multiple cloud regions simultaneously, with data replicated between them.

• Highest level of availability and resilience.
• All regions handle live traffic.
• Requires complex data synchronization (often synchronous).

Memory trick: Availability: Active-Active means always on, everywhere.

The practice of managing and provisioning computing infrastructure through machine-readable definition files, rather than physical hardware configuration or interactive configuration tools.

• Treats infrastructure like application code.
• Enables version control, auditing, and rollback.
• Promotes consistency and reduces configuration drift.

Memory trick: Code Your Infra for Control.

The encryption of data while it is stored on disk, in databases, or other persistent storage media, protecting it from unauthorized access if storage is stolen or compromised.

• Protects against physical theft or improper disposal of storage media
• Common example: AES-256 disk/volume encryption
• Complements encryption in transit and encryption in use for full data protection

Memory trick: Rest, Transit, Use — lock the safe, the armored truck, and the workshop.

A geographically distributed network of proxy servers and their data centers, used to provide high availability and performance by distributing content closer to end-users.

• Caches static and dynamic content at edge locations.
• Reduces latency and improves page load times.
• Mitigates DDoS attacks by absorbing traffic.

Memory trick: CDN: Content Delivers Nimbly.

A set of practices that combines software development (Dev) and IT operations (Ops) to shorten the systems development life cycle and provide continuous delivery with high software quality.

• Emphasizes collaboration, communication, and integration.
• Automates processes across the software delivery lifecycle.
• Focuses on shared responsibility and continuous improvement.

Memory trick: Culture of collaboration, automation's embrace, shared responsibility, and a continuous race.

A service level agreement guaranteeing 99.999% uptime, translating to very minimal downtime per year, often associated with mission-critical systems.

• 99.999% uptime is known as 'five nines'.
• Corresponds to approximately 5 minutes and 15 seconds of downtime per year.
• Requires robust architecture, often multi-region active-active.

Memory trick: Five Nines: Only 31 seconds gone, like a quick blink.

A subnet within a Virtual Private Cloud (VPC) that does not have a direct route to an Internet Gateway, thus isolating its resources from direct public internet access.

• Resources are only accessible from within the VPC or via a VPN/Direct Connect.
• Used for databases, application servers, and other sensitive resources.
• Can still initiate outbound internet connections via a NAT Gateway.

Memory trick: Private means Protected from Public.

A HIPAA Privacy Rule requirement that limits access, use, and disclosure of protected health information to the minimum needed to accomplish the intended purpose.

• Applies to workforce access, disclosures, and requests for PHI
• Encourages role-based restrictions on data fields
• Does not apply to treatment-related disclosures between providers

Memory trick: Only take the slice of pie you need, not the whole cake of patient data.

A security control that responds to and remediates the effects of a security incident after it has occurred.

• Examples: restoring from backup, patching a vulnerability, quarantining infected hosts
• Applied after detection has already identified the incident
• Goal is to return systems to normal, secure operation

Memory trick: PDC-C: Prevent the fire, Detect the smoke, Correct the damage, Compensate if the sprinkler is broken.

A GDPR data subject right (Article 17) allowing individuals to request deletion of their personal data under certain conditions, also known as the 'right to be forgotten.'

• Applies when data is no longer necessary or consent is withdrawn
• Organizations must comply unless legal obligation requires retention
• Part of the broader set of GDPR data subject rights

Memory trick: Erasure = 'Erase me from the Records'

Deploying an application across multiple, geographically separate cloud regions to achieve high availability and disaster recovery.

• Provides resilience against regional failures.
• Increases latency due to geographical distance.
• Typically more complex and costly to manage.

Memory trick: Regions make resilience, zones make it strong, but single points make it wrong.

A security control designed to identify and alert on security incidents or policy violations after they have occurred, enabling investigation and response.

• Examples include SIEM alerts, IDS, and audit logs
• Does not prevent the incident, only detects it
• Complements preventive controls in a layered defense strategy

Memory trick: Detective = the 'detective' who spots the crime after it happens

Rehosting (lift-and-shift) is moving an application to the cloud with minimal changes. Refactoring is re-architecting an application to fully leverage cloud-native capabilities, improving agility and cost-efficiency.

• Rehosting: Speed, low initial effort, less optimization
• Refactoring: Higher initial effort, significant long-term benefits
• Both are cloud migration strategies (from the '6 R's')

Memory trick: Lift-and-Shift is easy moving; Refactor is remodeling.

The use of software to perform repetitive tasks in cloud environments, enhancing efficiency, consistency, and reducing human error.

• Reduces manual effort for routine operations.
• Ensures consistent configurations across resources.
• Often integrated with orchestration tools for complex workflows.

Memory trick: Robots in the cloud fix everything automatically.

A cloud governance mechanism that enables organizations to define and enforce rules (policies) across their cloud resources to ensure compliance, security, and cost optimization.

• Automates compliance checks and remediation.
• Can enforce tagging, resource types, and configurations.
• Helps maintain security posture and cost control in dynamic cloud environments.

Memory trick: Govern the cloud with careful Policies, Security, and Access.

The probability that a stored object will not be lost over a given period, typically expressed as 'nines' (e.g., 99.999999999%).

• Measures data loss prevention, not service uptime.
• Higher 'nines' indicate extremely low probability of data loss.
• Achieved through redundancy, replication, and error correction.

Memory trick: Durability is about loss, not uptime; calculate total objects, then multiply by the chance of a bust.

Authentication categories used to verify identity, combining two or more independent factors to strengthen security beyond a single password.

• Knowledge factor: something you know, like a password
• Possession factor: something you have, like a token or phone
• Inherence factor: something you are, like a fingerprint

Memory trick: KIP: Know it, have IT, be it - three ways to prove who you are

Metadata labels applied to cloud resources to categorize and track costs for specific projects, departments, or environments.

• Enables granular cost visibility and chargeback/showback.
• Helps identify cost centers and optimize spending.
• Can be used in conjunction with billing reports and dashboards.

Memory trick: Tags for the budget, quotas for the limit, consolidated for the bill, firewall for the grit.

A cloud storage type that organizes data in a hierarchical file and folder structure, accessible via network file protocols like NFS or SMB, allowing multiple computing instances to share data.

• Shared access for multiple VMs.
• Uses standard file protocols (NFS, SMB).
• Acts like a traditional NAS.

Memory trick: Objects BLOCK FILES for ARCHIVE.

The capability of a service mesh to provide deep insights into the behavior of services within a microservices architecture, including traffic flow, latency, errors, and traces.

• Offers detailed metrics for inter-service communication.
• Enables distributed tracing across service calls.
• Provides centralized logging for microservice interactions.

Memory trick: Mesh Your Services for Deep Insight.

A risk management strategy that reduces the likelihood or impact of a risk through proactive controls, rather than eliminating, accepting, or transferring it.

• Involves adding safeguards like backups, redundancy, or scheduling
• Does not eliminate risk entirely, just reduces it
• One of four core risk response strategies

Memory trick: MATA: Mitigate, Avoid, Transfer, Accept

A cloud migration strategy that involves fundamentally changing an application's architecture to fully embrace cloud-native features and optimize for cloud benefits.

• Highest level of effort and cost initially.
• Maximizes cloud benefits (scalability, agility, cost).
• Examples: Microservices, serverless functions.

Memory trick: Remember the '6 Rs' for moving to the cloud.

A process for maintaining consistency of a product's performance, functional, and physical attributes with its requirements, design, and operational information throughout its life. In cloud, it ensures consistent resource configurations.

• Ensures resources adhere to a desired state.
• Detects and remediates configuration drift.
• Often uses tools like Ansible, Puppet, Chef, SaltStack.

Memory trick: Config management keeps everything in line.

Cloud providers offer infrastructure distributed across multiple geographic regions, each containing several isolated availability zones, to ensure high availability and low-latency access globally.

• Regions are distinct geographic areas (e.g., US East, Europe West).
• Availability Zones are isolated locations within a region, connected by low-latency links.
• Critical for disaster recovery, business continuity, and global performance.

Memory trick: Global regions for global reach and resilience.

Cloud services that provide a dedicated, private network connection from an on-premises data center or corporate network to a cloud provider's network, bypassing the public internet.

• Offers higher bandwidth and lower latency than VPNs.
• Enhances security by not traversing the public internet.
• Ideal for hybrid cloud, large data transfers, and critical applications.

Memory trick: Private data needs a direct, dedicated road to the cloud.

A cloud storage class optimized for extremely low-cost storage of data that is rarely accessed and can tolerate retrieval times ranging from minutes to hours. Ideal for long-term backups and compliance data.

• Lowest per-GB storage cost.
• Highest retrieval costs.
• Longest retrieval times (hours).

Memory trick: STANDARD INFREQUENT ARCHIVES save money.

A risk response strategy where an organization decides to tolerate a low-impact or low-probability risk without further treatment, after documenting the decision.

• Used when treatment cost exceeds potential impact
• Risk is still tracked/monitored, not ignored
• One of four standard risk response strategies alongside avoidance, mitigation, and transfer

Memory trick: A-M-T-A: Avoid, Mitigate, Transfer, Accept the risk.

The IAM process step that verifies a user's claimed identity, commonly strengthened through multi-factor authentication (MFA) combining something you know, have, or are.

• MFA reduces risk from stolen passwords alone
• Distinct from authorization, which controls access rights
• Part of the Identification-Authentication-Authorization-Accounting (IAAA) model

Memory trick: MFA = a second lock added to the authentication door

The practice of automatically starting, stopping, or adjusting cloud resources based on predefined time-based rules or events.

• Optimizes cost by shutting down unused resources.
• Ensures resources are available when needed.
• Reduces manual operational overhead.

Memory trick: Time is Money in the Cloud.

A disaster recovery strategy where an application runs simultaneously in multiple cloud regions, with traffic distributed across all active regions. This provides the highest availability and resilience.

• Applications are fully operational in all regions.
• Provides near-zero RTO and RPO.
• Highest cost among DR strategies.
• Ideal for critical applications requiring continuous availability.

Memory trick: DR plans range from waiting to always-on.

The ability of a cloud computing system to automatically increase or decrease the amount of computing resources in real-time, based on the current workload or demand.

• Automatic scaling up and down.
• Optimizes cost by only paying for resources when needed.
• Ensures performance during peak and off-peak times.

Memory trick: Elasticity stretches and shrinks with the flow.

The principle that data is subject to the laws and legal jurisdiction of the country in which it is collected or physically stored.

• Distinct from data residency (physical location only)
• Impacts cloud provider and data center selection
• Foreign government access laws (e.g., CLOUD Act) can create sovereignty conflicts

Memory trick: Sovereignty = whose laws Sit over your data

An independent auditor's report assessing a service organization's security, availability, and confidentiality controls over a sustained period, used by customers to gain assurance without conducting their own audits.

• Type II evaluates controls over time (e.g., 6-12 months); Type I is a snapshot
• Based on AICPA Trust Services Criteria
• Commonly requested during cloud vendor due diligence

Memory trick: SOC 1 is financial, SOC 2 is security, SOC 3 is public summary

A security discipline that secures, controls, and monitors access for privileged/administrative accounts, often using credential vaulting, just-in-time access, and session recording.

• Reduces risk of standing privileged credentials
• Uses vaults for time-limited credential checkout
• Session recording enables auditing and forensics
• Distinct from general IAM which covers all user types

Memory trick: 'PAM guards the crown jewels' by locking admin keys in a vault.

A dedicated network connection from an on-premises location to a cloud provider, bypassing the public internet.

• Provides consistent bandwidth and lower latency.
• Enhanced security due to private connection.
• More reliable than internet-based VPNs.

Memory trick: Cloud Connect: Direct is best for speed and security.

Capital Expenditure (CapEx) involves upfront investments in physical assets, while Operational Expenditure (OpEx) refers to ongoing costs for services and operations. Cloud computing typically shifts IT spending from CapEx to OpEx.

• CapEx: upfront, depreciated assets (e.g., servers)
• OpEx: ongoing, recurring costs (e.g., subscription fees, utilities)
• Cloud generally reduces CapEx and increases OpEx
• PaaS often reduces OpEx related to IT staff compared to IaaS

Memory trick: PaaS: Pay Less for people, focus on product.

An assessment of how well the proposed cloud solution will be implemented and operated within the organization, considering existing processes, workflows, and human resources.

• Evaluates impact on staff and organizational structure
• Assesses training needs and process changes
• Determines if the organization can effectively use and manage the solution

Memory trick: TELOS: Technical, Economic, Legal, Operational, Schedule.

A lightweight, standalone, executable package of software that includes everything needed to run an application: code, runtime, system tools, system libraries, and settings. They share the host OS kernel.

• Isolated, lightweight environments.
• Fast startup times.
• Efficient resource utilization.

Memory trick: BARE VIRTUAL CONTAINERS SERVE functions.

A software licensing model where users pay a recurring fee (e.g., monthly or annually) to use the software, typically including updates and support.

• Recurring payment model
• Often includes updates and support
• Common for SaaS applications

Memory trick: Think of software licenses like movies: Perpetual (buy the DVD), Subscription (Netflix), Open Source (free YouTube), Freemium (ad-supported app).

An SLA defines the level of service expected from a vendor. Uptime guarantees are calculated by determining the maximum allowed downtime based on the percentage and total time period.

• Total time period (e.g., month) is crucial
• Uptime % dictates allowed downtime %
• Convert all times to a consistent unit (minutes/hours)

Memory trick: SLA: Calculate total minutes, find allowed downtime, compare to actual.

A security principle stating that users, accounts, and processes should be granted only the minimum level of access necessary to perform their required functions.

• Reduces attack surface and potential damage from compromised accounts
• Applies to users, applications, and system processes alike
• Often implemented alongside RBAC and periodic access reviews

Memory trick: Give each key only to the doors that person actually needs to open.

A discrepancy identified during a cloud assessment where existing technical infrastructure, tools, or policies are incompatible or insufficient for the target cloud environment, requiring new technical solutions or adaptations.

• Relates to infrastructure, software, security tools
• Identifies incompatibilities or insufficiencies
• Requires new technical solutions or architectural changes
• Distinct from process, regulatory, or organizational gaps

Memory trick: GAPS: Goals, Architecture, People, Security.

Migrating an application to the cloud with some minor optimizations to take advantage of cloud capabilities, without altering the core architecture.

• Less effort than refactoring, more than rehosting.
• Involves changing some components (e.g., self-managed database to managed database service).
• Aims to improve scalability or reduce operational burden without extensive code changes.

Memory trick: Replatform: Lift and Reshape, not Rebuild.

A Service Level Agreement (SLA) specifies the guaranteed uptime for a cloud service, often expressed as a percentage, which dictates the maximum allowable downtime over a given period.

• Calculated as (Total Time - Downtime) / Total Time.
• Expressed in 'nines' (e.g., 99.9%, 99.999%).
• Higher nines mean lower allowed downtime.

Memory trick: TOTAL time minus UPTIME equals DOWNTIME.

Isolating the cardholder data environment (CDE) on a separate, firewalled network segment so that only in-scope systems require PCI DSS assessment.

• Reduces cost and complexity of annual PCI DSS audits
• CDE must have no unrestricted communication with out-of-scope systems
• Often combined with tokenization for further scope reduction

Memory trick: Build a moat around the cardholder data castle to keep auditors out of the rest of town.

A framework outlining the security responsibilities between a cloud provider and a customer, where the provider handles the platform and infrastructure, and the customer handles their applications and data.

• Provider: OS, middleware, runtime, network, storage, physical security.
• Customer: Applications, data, configuration, access management.
• Responsibilities shift based on service model (IaaS, PaaS, SaaS).

Memory trick: PaaS: Provider 'P'atches and 'P'latform, Customer 'C'odes and 'C'onfigures.

A disaster recovery strategy where a scaled-down but fully functional duplicate of the production environment is maintained in a separate region, ready to be scaled up and receive traffic during a disaster.

• Lower RTO than Pilot Light or Backup & Restore.
• Higher cost than Pilot Light but lower than Active-Active.
• Requires ongoing synchronization of data.
• Suitable for applications needing faster recovery than basic backups.

Memory trick: Warm Standby is Ready to Get Hot.