Cloud Architecture
- Service models IaaS, PaaS, SaaS and FaaS, the shared responsibility model
- Availability: regions, availability zones, cloud bursting, edge computing, availability monitoring; disaster recovery with RTO and RPO, hot, warm and cold sites; multi-cloud
- Cloud networking: VPN and dedicated connections, load balancers, application gateway, CDN, firewalls, VPC with peering and transit gateway, subnets, VLAN, SDN, BGP, static routes and routing tables
- Storage: storage tiers hot, warm, cold and archive, SSD and HDD, object, block and file storage and their impact on performance and cost
- Cloud-native design concepts: managed services, microservices, loosely coupled architecture, fan-out, service discovery
- Containers (orchestration, port mapping, persistent and ephemeral storage, image registries) and virtualisation (clustering, cloning, host affinity, hardware passthrough, overlay and VM networking, local storage, SAN and NAS)
- Cost: billing models with dedicated hosts, reserved resources, pay-as-you-go and spot instances, resource metering, tagging, rightsizing
- Relational and non-relational databases, self-managed or provider-managed; optimise workloads for compute, network (latency, throughput) and storage (IOPS, throughput)
- Emerging technologies: machine learning and AI including generative AI, Internet of Things (IoT)
Deployment
- Deployment models: public, private, hybrid and community cloud
- Deployment strategies: blue-green, canary, rolling and in-place
- Migration from on-premises to the cloud, back again, and between clouds; criteria such as platform compatibility, cost, management overhead, availability, vendor lock-in, environmental and compliance requirements; strategies: rehost, replatform, refactor, re-architect, retain and retire
- Provision resources through code: Infrastructure as Code and Configuration as Code, script logic, repeatability, drift detection, versioning, testing and documentation, JSON and YAML formats
- Provision cloud resources to match requirements for storage, performance, security, cost, availability, compliance, network and compute
Operations
- Observability: logging with collection, aggregation and retention, tracing, monitoring with metrics, alerting with triage and response
- Scaling: triggered by trends, load or events, scheduled or manual; horizontal and vertical
- Backup and recovery: full, incremental and differential backups, storage locations, scheduling, retention, replication, encryption, recovery testing, in-place and parallel as well as full or granular recovery
- Lifecycle of cloud resources: patches, major and minor versions, testing, ephemeral and persistent data, decommissioning at end of life and end of support
Security
- Vulnerability management: scan scope, identification, assessment and remediation, CVEs
- Compliance and regulation: data sovereignty, data ownership, data locality, data classification, retention including litigation hold; standards such as SOC 2, PCI DSS, ISO 27001 and Cloud Security Alliance
- Identity and access management: secure access to the management environment and resources via API, SDK, CLI, web portal, SSH, RDP and bastion host; federation with SAML, token- and directory-based authentication, MFA, OpenID Connect; RBAC, group-based access control, OAuth 2.0; audit trail
- Best practices: zero trust, CIS and vendor-specific benchmarks, hardening, patching, encryption of data in transit and at rest, secrets management, API security, least privilege, container and storage security
- Security controls: endpoint protection, DLP, IDS/IPS, DDoS protection, IAM policies, network ACLs, WAF and network security groups
- Detect suspicious activity: event monitoring, deviations from the baseline, unnecessarily open ports; attacks such as exploitation of vulnerabilities, social engineering, malware and ransomware, DDoS, cryptojacking and zombie instances
DevOps Fundamentals
- Source control: version control, code review, pull requests, commit, push, merge and branch management
- CI/CD pipelines: automation, build, testing, security, artefacts such as VM and container images or packages (RPM, Debian, ZIP, tar), public and private repositories
- System integration: event-driven architectures, REST, SOAP, RPC, WebSockets and GraphQL
- Tools: Ansible, Docker, ELK stack, Git, GitHub Actions, Grafana, Jenkins, Kubernetes and Terraform
Troubleshooting
- Deployment issues: incompatibilities, misconfigurations in resource allocation, permissions, overprovisioning and sizing, outdated components and deprecated features, outages, resource limits such as API throttling and quotas, regional service availability
- Network issues: unavailable services such as DHCP, DNS, NTP, NAT and HTTP, latency and bandwidth, misconfigured devices, protocol incompatibilities, IP addressing, routing, and VLAN tags and access or trunk ports
- Security issues: outdated cipher suites, authorisation and authentication issues such as privilege escalation, unauthorised access and leaked credentials, software vulnerabilities and unauthorised software
