Glossary

Over 3,500 key terms for IT certifications — AWS, Azure, GitHub, Google Cloud, LPI, and IPA — with plain-language definitions. Search or filter by certification; pick a certification to see each term's related and prerequisite terms. When you're signed in, your understanding of each term (set automatically from your answers, reviews, and vocabulary) shows as a badge you can also adjust by hand. Highlighted terms in the textbook show their meaning on hover or click, and you can export to flashcards (Anki / Quizlet) or explore the knowledge map.Back to the textbook

2-step verification (2SV)

Authentication strengthening that requires a second factor in addition to a password; enforceable per OU/group, with methods ranging from SMS/prompts to the strongest security keys/passkeys (FIDO).

4C (marketing)

A framework that reframes the 4Ps (Product/Price/Place/Promotion) from the seller's viewpoint into the buyer's, examining marketing measures through four elements: Customer Value, Cost to the Customer, Convenience, and Communication. Strategists use the 4C perspective when judging that marketing measures should be designed starting from the value and burden experienced by the customer, rather than from the features the firm wants to offer.

5-tuple

The combination of source IP address, destination IP address, source port, destination port, and protocol. This five-value tuple uniquely identifies a single communication flow, making it the basic starting point for pinpointing a compromised host or conversation from logs or NetFlow records.

100% rule

The principle that at every level of the WBS, the sum of child elements must represent exactly 100% of the parent scope, with no gaps or overlaps. Because incomplete or overlapping decomposition undermines estimate and schedule accuracy, this is an essential validation rule to apply when building a WBS.

A/B testing (Vertex AI)

Deploying multiple model versions to the same endpoint and specifying a traffic-split ratio to compare performance on real requests. If metrics degrade, traffic can be rolled back to the prior version quickly, letting you validate a new model while limiting production impact.

AAA (Authentication, Authorization, Accounting)

A collective term for three access-control functions. Authentication verifies who the user is, authorization decides what an authenticated user is permitted to do, and accounting records what was actually done. Cisco devices centralize these functions using RADIUS or TACACS+ as the AAA server.

ABAC (attribute-based access control)

An access model that decides access dynamically by attributes like tags. Matching aws:PrincipalTag with aws:ResourceTag in conditions (e.g., allow if the same department tag) scales without adding roles. Contrasted with role-based RBAC.

Absolute and relative paths

An absolute path starts from / (the full location, /etc/hosts); a relative path is from the current location (./script.sh, ../dir). Check the current directory with pwd.

Accelerated Networking

A feature that accelerates a VM NIC via SR-IOV, lowering latency and raising throughput; useful for SAP low-latency needs. NIC bandwidth itself scales with VM size. Distinct from a load balancer.

Accelerated Site-to-Site VPN

An option that routes VPN traffic through AWS Global Accelerator edge locations onto the AWS backbone network as early as possible, reducing latency and jitter over the public internet segment. Useful for geographically distant sites or latency-sensitive workloads.

Access Advisor (last-accessed info)

An IAM feature showing when a user/role/policy last accessed each service (last-accessed info). Used to identify unused, excessive permissions and tighten toward least privilege.

Access Approval

A feature that requires the customer's explicit pre-approval before Google staff can access data, e.g., for support. Where Access Transparency is an after-the-fact log, Access Approval adds an upfront approval gate—the two are combined for stronger sovereignty controls.

Access Context Manager

Defines access boundaries by context (access levels: device, source IP, region); integrates with VPC Service Controls and IAP for zero-trust-style control.

Access control (least privilege, separation of duties)

A mechanism that governs who is permitted which operations on which information assets. Its core principles are the principle of least privilege — granting only the minimum permissions needed for a task — and separation of duties — dividing a series of tasks among multiple people to prevent fraud and errors. It is operated together with authentication, authorization, and auditing (log recording).

Access log

A log recording requests a web server has received (source, timestamp, URL, status code, etc.). Apache writes it to access_log by default.

Access management (RBAC / least privilege / JIT)

Role-based access control (RBAC) grants permissions by job function, applies least privilege, and PIM just-in-time (JIT) elevation enables privileges only when needed.

Access package (entitlement management)

Defines a bundle of access a role needs (groups, apps, SharePoint) with a policy for who can request, who approves, and for how long. Users self-request via My Access; access auto-expires.

Access Port and Trunk Port

An access port belongs to a single VLAN and forwards untagged frames to end devices, while a trunk port carries frames for multiple VLANs over one physical link, tagging them (e.g., via IEEE 802.1Q) to identify their VLAN. On trunks, a native VLAN (the untagged default VLAN) mismatch between switches can create security issues such as VLAN hopping.

Access reviews

Periodically re-checks existing access (groups/apps/roles/guests) and removes what is not needed. Auto-apply removes denials automatically; PIM integration inventories privileged roles. The continuous-inventory counterpart to entitlement management (entry).

Access tiers (Hot/Cool/Cold/Archive)

Blob tiers optimizing storage cost by access frequency; lower tiers cost less to store but are slower/costlier to retrieve.

Access Transparency

A feature that logs when Google support/engineering staff access customer data for reasons like support cases—capturing who, when, why, and which resource. Enabled to meet audit requirements and transparency accountability, and viewable via Cloud Logging.

Accessibility

Designing so people with disabilities can use apps (contrast, alt text, keyboard, screen readers); Power Apps includes an accessibility checker.

Account files (/etc/passwd / shadow / group)

Three files holding account data: /etc/passwd has basic user info (world-readable, no real passwords), /etc/shadow the hashed passwords and aging (root-only), /etc/group the groups and members. Verify with id (UID/GID/groups) or getent (via NSS, including LDAP); set passwords with passwd.

Account management lifecycle

Managing user accounts through a continuous cycle covering onboarding (issuance and privilege assignment), transfer (access review and reconciliation), and offboarding (prompt deactivation and deletion). Failing to delete a departed employee's account, or leaving stale privileges after a transfer, creates an opening for insider misuse or unauthorized login, making periodic reconciliation tied to HR records essential.

Accountability

An extended information-security element denoting the ability to trace and identify after the fact who performed which operation and when. It is achieved through logging and preserving audit trails, supporting root-cause investigation of unauthorized access or errors and enforcing responsibility.

ACI (Application Centric Infrastructure)

Cisco's SDN architecture for the data center. An APIC (application policy infrastructure controller) centrally manages an entire spine-leaf fabric, letting application communication requirements be defined as policy (endpoint groups and contracts) and automatically pushed across the whole network. It is designed to be automated and integrated via a REST API and model-driven tooling.

ACID

Properties of reliable transactions: Atomicity, Consistency, Isolation, Durability.

ACID Properties

The collective term for the four properties a transaction must satisfy: Atomicity, Consistency, Isolation, and Durability. These principles guarantee database integrity even under failures or concurrent execution, and are implemented by the DBMS's transaction management mechanism.

ACL (Access Control List)

An ordered list of rules on a router or firewall that permit or deny traffic based on conditions such as source/destination IP address and port number. Rules are matched top to bottom, with an implicit deny applied at the end by default.

ACR (Azure Container Registry)

A private registry to store/manage container images; ACR Tasks builds in the cloud, and authentication uses a managed identity.

Act on Electronic Signatures and Certification Business

A law providing that an electronic record bearing an electronic signature meeting certain requirements (able to be created only by the signer, allowing detection of alteration, etc.) is presumed to have been created authentically. It is the legal basis for electronic contracts carrying the same legal effect as paper contracts.

Act on Proportionate Transactions for Small and Medium Sized Subcontractors

A law ensuring fair dealing when a commissioning business (formerly a parent enterprise) places orders with a small/medium subcontracted business (to take effect in 2026; formerly the Subcontract Act, renamed in Syllabus Ver.6.5). It prohibits practices such as delayed payment, unjust price reductions, and beating down prices, and regulates payment methods such as paying by bills that are hard to discount (e.g., bills with excessively long terms) - it does not blanket-prohibit bill payment.

Act on the Prohibition of Unauthorized Computer Access

A law prohibiting unauthorized network login to a computer using another person's ID and password without permission, as well as acts that assist such access. Beyond misuse of another's ID and password, it also prohibits unauthorized access exploiting security holes and the unauthorized retention or provision of illicitly obtained IDs and passwords (including those obtained through phishing).

Act on the Protection of Personal Information

A law that requires businesses handling information that can identify a specific individual, such as name and date of birth, to specify the purpose of use, acquire data appropriately, implement safety-management measures, and restrict third-party disclosure without the individual's consent.

Act on the Provision of Information Distribution Platforms

A law that requires large-scale platform operators such as SNS providers to respond more quickly to takedown requests for rights-infringing content (defamation, etc.) and to publish their operational practices. It is an amendment and renaming of the former Provider Liability Limitation Act (in effect under Syllabus Ver.4.1). Note that the old name, "Provider Liability Limitation Act," is no longer used in the current syllabus.

Action

The steps run after the trigger (save file, notify, approve, update data); operate external services via connectors and run in sequence.

Action input (INPUT_/getInput)

How to read with:-passed inputs inside an action—via the INPUT_<NAME> env var, or @actions/core getInput in JavaScript actions.

Action types (JavaScript/Docker/composite)

Three types: JavaScript (Node.js, cross-platform, fast), Docker container (bundles an environment but Linux-runner only, slower start), and composite (a bundle of steps).

Action use policy

An org/enterprise setting governing which actions can run: disable all / allow all / GitHub-authored only / GitHub + verified / an allow list of specific actions. Can also require SHA pinning for external actions.

action.yml (metadata)

The required metadata file at an action’s root; defines name, description, inputs, outputs, runs (using = node20/docker/composite), and branding. Must match runs.using to the implementation to start.

Actions cost optimization

Reducing Actions consumption via paths/branches filters, concurrency, caching, minimizing matrices, and right-sizing runners—cutting waste without lowering quality.

ACTIONS_STEP_DEBUG

A secret that, when set, enables step-execution debug logging; used to investigate failures the normal logs don’t explain.

Activation and loss functions

Hidden layers use ReLU (resists vanishing gradients; Leaky ReLU/GELU for dying ReLU). Choose the output layer by task: regression = linear + MSE, binary = sigmoid + binary cross-entropy, multi-class (exclusive) = softmax + categorical cross-entropy, multi-label (non-exclusive) = per-output sigmoid. softmax sums to 1 so it is unfit for multi-label. Optimizers: SGD/Momentum/RMSProp and the default Adam.

Active and passive reconnaissance

Reconnaissance to gather information about a target. Active reconnaissance sends traffic directly at the target (e.g., port scanning) and infers information from the responses, and so can be detected; passive reconnaissance only collects publicly available information (company sites, social media, DNS records, and the like) and is much less likely to alert the target.

Active Assist and recommenders

Analyzes usage and auto-surfaces insights and recommendations—idle-resource removal, rightsizing oversized instances, reducing over-privileged IAM—across cost/security/performance/manageability/reliability categories.

Active Directory

Microsoft's directory service for centrally managing user accounts, computers, and groups in a Windows environment. It functions as the identity store governing who in an organization can access what, underpinning login authentication and access-rights assignment.

Active geo-replication

A DR feature asynchronously creating a readable secondary in another region. It supports manual failover and up to four secondaries.

Activity diagram

A UML behavioral diagram that represents a sequence of business or processing flow as a chain of actions (rounded boxes). It can express branching/merging and concurrent processing (fork/join), and swimlanes can partition work by actor or role, making it well suited to modeling business flows and procedures. Its purpose differs from a state machine diagram, which shows the state changes of a single object.

Actual cost (AC)

The cumulative cost actually incurred for the work completed during a given period (whether or not payment has been settled). Comparing it against EV yields cost efficiency (CPI), and on its own it shows how the budget is being consumed.

ADC resolution and quantization

The resolution of an analog-to-digital converter (ADC) is expressed in bits: an n-bit converter divides the analog input range into 2^n discrete levels. This discretization (quantization) inherently introduces a quantization error — the difference from the original value — which shrinks as resolution increases, at the cost of higher price and conversion time. Choosing a resolution that is just sufficient for the sensor accuracy requirement is a key design decision.

Address classes and public addresses

IPv4 addresses are classified as Class A through E by the pattern of their leading bits (Class A starts 1-126, Class B 128-191, Class C 192-223, and so on), which historically set the default network/host boundary. Unlike a private address, a public address is one that is uniquely routable on the internet.

Admin consent workflow

Lets users request app permissions and admins review/approve—curbing user consent to risky permissions and reducing consent-phishing risk. Used together with consent policies.

Administrative distance (AD)

A value indicating how trustworthy a routing information source is relative to others; a smaller value is preferred. When routes of equal prefix length are learned from multiple protocols, AD decides the source priority before comparing metrics (e.g., static 1, OSPF 110, RIP 120).

Administrative units (AUs)

Scopes an Entra role’s application to a subset of users/groups/devices—e.g., delegating Password Administrator over only a region’s users. Unlike tenant-wide roles, it narrows scope to keep least privilege.

ADMX import (Intune)

A feature that ingests registry-based settings defined in administrative templates (ADMX/ADML files) into Intune, making them deployable as an "Imported Administrative templates" configuration profile. Third-party ADMX settings not yet in the Settings Catalog (e.g., for Office) can also be added as custom ADMX.

Adoption Score and usage analytics

A measure that visualizes Microsoft 365 adoption, analyzing usage like collaboration and content creation to drive enablement.

Advanced Analytics (Intune Suite)

An Intune Suite add-on that extends standard Endpoint Analytics metrics with proactive analysis across the fleet, such as anomaly detection and root-cause analysis of device failures. It surfaces trends before issues become widespread, giving IT an early trigger to remediate.

Advanced hunting (KQL)

Uses KQL in Defender XDR / Sentinel to proactively hunt threats across telemetry, turning queries into analytics rules for automated detection.

Advisor for Teams

A deployment aid to plan large org-wide Teams rollouts and check readiness/recommendations.

Advisory-type audit

A form of audit whose primary purpose is to evaluate the audited area and offer concrete recommendations for improvement, rather than to express a formal assurance conclusion. The auditor is expected to go beyond pointing out deficiencies and propose practical remedies. Because this collaborative style brings the auditor closer to the audited unit than an assurance-type audit, extra care is needed to preserve independence.

Agent (agentic AI)

AI that, beyond returning text, autonomously plans, uses tools, and acts over multiple steps toward a goal.

Agent (Copilot Studio)

A conversational assistant built in Copilot Studio (formerly bot/chatbot); handles questions and real actions via topics, knowledge, and Power Automate.

Agent administration

Govern agents through a lifecycle: configure user access (least privilege) → create → approval process → monitor. Monitoring uses the Microsoft 365 admin center and the Microsoft Power Platform admin center for usage, operational insights, and lifecycle.

Agent evaluations

An evaluation capability that measures an agentic application's task completion rate, appropriateness of tool calls, and reasoning quality. It continuously checks response quality—including for RAG-backed agents—via human or automated metrics, informing improvements to prompts and tool definitions.

Agent loop (reason → act → observe)

The control structure where an agent iterates "reason (decide next step) → act (call a tool/function) → observe (incorporate the result)" until the goal is met (e.g., ReAct). Max iterations, timeouts, stopping conditions, and human approval prevent infinite loops or runaway behavior.

Agent Mode

Given a goal, autonomously iterates plan → edit → verify via build/test → fix, deciding which files and commands it needs.

Agent safety controls

Controls that prevent autonomous agents from running away, misbehaving, or being abused: stopping conditions, max iterations, timeouts, IAM boundaries (least privilege) limiting tools/actions, human-in-the-loop approval, and Guardrails inspecting inputs/outputs.

Agent session

The unit managing Agent Mode work; you can check progress, pause, and resume.

Agent-based automation (Puppet/Chef)

A pull-style automation approach in which a resident agent is pre-installed on each managed device or server, and that agent periodically checks in with a master to fetch and apply configuration. Puppet and Chef are the leading examples. It contrasts with Ansible, which is agentless and pushes configuration over SSH; the tradeoff is the cost of installing and maintaining the agent, in exchange for being well suited to continuously self-healing drift.

Agents (Copilot)

Customizable AIs specialized for specific tasks/knowledge that work semi-autonomously. Built-in Researcher (deep cross-source research) and Analyst (data analysis/visualization), plus custom agents built for org-specific needs.

Agents for Amazon Bedrock

Amazon Bedrock Agents (formerly Agents for Amazon Bedrock): a Bedrock capability that breaks tasks into steps and autonomously executes multi-step processing by calling APIs (action groups) and knowledge bases.

Aggregate functions (count/sum/avg/max/min)

Functions that summarize multiple rows into a single value: count (count(*) counts all rows) returns the row count, sum returns the total, avg returns the average, and max/min return the maximum/minimum. Commonly combined with GROUP BY for per-group aggregation.

Aggregate functions (Sum, CountRows, etc.)

Functions that aggregate table values: Sum (total), Average, CountRows (count), Max/Min.

Aggregated sink

A log sink that collects logs across an organization or folder at once and exports to BigQuery/Cloud Storage/Pub/Sub; used for SIEM forwarding and long-term retention—a higher-level form of a single-project log sink.

Aggregation and composition (UML association kinds)

Two UML class-diagram associations expressing whole-part relationships. Aggregation (hollow diamond) is a loose ownership where the part can exist independently of the whole; composition (filled diamond) is a strong ownership where the part is destroyed with the whole. Often tested together with multiplicity notation.

Agile development and Scrum

Agile development is an umbrella term for development approaches that repeat short cycles (iterations) of planning, design, implementation, and testing to respond flexibly to changing requirements. Scrum is a representative agile method that repeats short cycles called sprints.

Aging

A scheduling technique that gradually increases the priority of a process as its waiting time grows. It is used to prevent starvation and ensure fairness among waiting processes.

Aging (MAC address table)

The lifetime assigned to each entry in an L2 switch's MAC address table. An entry with no traffic for a set period (300 seconds by default on Cisco) is automatically removed (aged out), preventing table bloat and letting a moved host be correctly re-learned.

AH (Authentication Header)

One of the protocols composing IPsec; it provides integrity and source authentication for IP packets but does not encrypt (no confidentiality). Because it also authenticates the IP header, it conflicts with NAT, which rewrites addresses in transit; use ESP when confidentiality is required.

AI Builder

A Power Platform capability to add AI (form/invoice reading, prediction, classification, object detection) to apps/flows with low code.

AI Builder model types

The AI types in AI Builder—form processing (extract from documents), object detection, prediction, category classification, text recognition—trained/used low-code.

AI Gateway (API Management)

Placed in Azure API Management to centrally authenticate, rate-limit, monitor, and manage token consumption for Microsoft Foundry model access, hiding backend keys. Distinct from Foundry guardrails (model/agent-side safety filters).

AI governance

A framework for governing generative AI across an organization: model cards (documenting use/limits), data/model lineage (provenance), CloudTrail audit trails, plus approval flows and access control—ensuring accountability, compliance, and reproducibility.

AI hallucination

A phenomenon in which generative AI produces information not grounded in fact as plausible-sounding text. It underscores the importance of user literacy in not accepting AI output at face value and instead fact-checking the grounds for it.

AI infrastructure (TPU)

Google specialized hardware powering training/inference for large-scale AI; the TPU (Tensor Processing Unit) is key and relates to cost and sustainability (power).

AI observability (tracing/token monitoring)

Uses Application Insights and Foundry tracing to record per-request latency, token consumption, cost, and errors for continuous quality/performance monitoring.

AI services opt-out policy

An AWS Organizations-level policy that stops Amazon from using customer data to improve AI/ML services, applied across the whole organization at once. It is a type of Organizations policy that avoids configuring each account individually and helps meet data governance requirements.

AKS security

Secures Kubernetes workloads via AKS network isolation (private clusters, network policies), Entra-integrated authentication/authorization, and monitoring with Defender for Containers.

Alarm missing-data treatment / evaluation period

Alarm design elements: the evaluation period (M of N datapoints breaching) reduces flapping; missing-data treatment (notBreaching/breaching/ignore/missing) sets behavior when data is absent. A common SOA tuning point.

ALB features (routing/sticky/target group)

ALB listener rules route by path (/api/*) or hostname to a target group. Sticky sessions pin a client to the same target (via cookie); X-Forwarded-For is the header that conveys the original client IP.

Alert dismissal and ownership

Dismiss alerts only for false positives/accepted cases with recorded reasons (careless dismissal leaves risk). Clarify ownership so who responds/remediates is clear, preventing neglect or duplicate work.

Alert rules

A mechanism configured under Notifications & alerts > Rules in the Teams admin center that monitors device/resource health. Its main example, the Device state rule, notifies admins when the state of Teams Rooms devices, SBCs (Session Border Controllers), etc. changes to Unhealthy. It does not notify on usage-volume metrics like active user counts crossing a threshold; unlike usage reports (which you actively check), this is a passive notification mechanism focused specifically on device/equipment health.

Alert tuning

In Microsoft Defender XDR, rules (formerly called suppression rules) that automatically resolve or suppress alerts matching known-benign activity or false-positive patterns under specified conditions. Reduces noise from org-specific legitimate behavior (e.g., approved tools) so analysts focus on real threats.

Alerts and notifications (Intune)

An Intune feature that notifies admins based on preconfigured alert rules when it detects events like compliance drift, a spike in enrollment failures, or configuration conflicts. Distinct from report visualization, its role is proactively pushing notifications when a threshold is crossed.

Alias / shell builtin

An alias is an alternate name for a command (alias ll='ls -l') that shadows a同名 command; a shell builtin (cd, echo) is built into the shell itself with no external executable.

Alias records

A Route 53-specific record that resolves to AWS resources (ELB, CloudFront, S3, API Gateway) even at the zone apex. It works like a CNAME at no extra charge.

AlloyDB

A high-performance, PostgreSQL-compatible managed database.

ALM (application lifecycle management)

The practice of managing and promoting apps dev→test→prod; in Power Platform, done with solutions, environments, and pipelines.

Alt text

Text describing a visual for screen readers; a basic of accessible report design, used with tab order and contrast.

ALTER DATABASE ... SET

DDL that permanently overrides a configuration parameter for a specific database, applying to every connection to that database. Precedence runs from most to least specific: session SET > ALTER ROLE ... IN DATABASE (role+database) > ALTER ROLE (role) > ALTER DATABASE (database) > postgresql.conf.

ALTER ROLE ... SET

DDL that permanently overrides a configuration parameter for a specific role. It applies to every session started under that role, making it more persistent and broader in scope than a session-level SET command; ALTER ROLE ... IN DATABASE ... SET can further restrict it to one target database.

Alternate keys

Uniquely identify Dataverse records by an external system’s key (e.g., order number), used when the GUID primary key is unknown externally.

Always Encrypted

Encrypts sensitive Azure SQL columns (e.g., credit card numbers) on the client so the server never sees plaintext. Keys (the column master key) live on the client or in Key Vault. Since the server can’t see plaintext, queries are generally limited (e.g., equality); range operations require Secure Enclaves. Unlike TDE (at rest only), it protects data in use—even from DBAs.

Always Encrypted with VBS enclaves

Always Encrypted using virtualization-based security (VBS) enclaves, enabling server-side operations like range comparisons and pattern matching on still-encrypted data.

Always On availability groups

On SQL Server on VM / Managed Instance, replicates a set of databases across replicas (sync/async) to provide HA/DR.

Amazon API Gateway

A fully managed service to create, publish, and manage REST/HTTP/WebSocket APIs, with throttling, authorization (Cognito/Lambda authorizers), stages, usage plans, and caching; backed by Lambda and more.

Amazon AppFlow

A fully managed integration service that securely transfers data between SaaS apps (Salesforce, SAP, Zendesk, etc.) and AWS, configuring flows with no code.

Amazon Application Recovery Controller (ARC)

A service to control availability and disaster recovery of multi-Region/multi-AZ applications. It continuously checks each cell’s readiness and provides routing controls to perform failover (traffic shifting) safely, giving governance to execute complex recovery actions reliably.

Amazon Athena

A serverless service running Presto/Trino-based SQL on S3 data. Billed per data scanned, so Parquet conversion + partitioning greatly cuts cost. Uses the Glue Data Catalog for metadata.

Amazon Augmented AI (A2I)

A service to build human review (human-in-the-loop) workflows for ML predictions, routing low-confidence predictions to people to ensure quality.

Amazon Aurora

A cloud-native, MySQL/PostgreSQL-compatible database. Storage is 6-way replicated across 3 AZs with self-healing and auto-growth (up to 128 TiB); up to 15 read replicas, failover usually under 30s—higher availability/performance than RDS.

Amazon Bedrock

A fully managed service to access foundation models from multiple providers via API and build generative AI into apps; also Knowledge Bases (RAG), agents, and Guardrails.

Amazon Bedrock AgentCore

An agent platform to run production AI agents with any framework (CrewAI/LangGraph/LlamaIndex/Strands) and any model. Modular services: Runtime (serverless, session isolation), Memory (short/long-term), Gateway (turn APIs/Lambda into MCP tools), Identity (agent auth), Code Interpreter, Browser, and Observability—no infrastructure to manage.

Amazon Bedrock Data Automation

An automated processing workflow that generates structured output from unstructured data (documents, images, audio, video), automating data preparation for GenAI apps.

Amazon Bedrock Knowledge Bases

A managed RAG capability: Bedrock ingests data sources (e.g., S3) and handles chunking, embedding generation, storage in a vector store (OpenSearch Serverless/Aurora pgvector, etc.), retrieval, and cited answers—delivering grounded generation without building your own retrieval stack.

Amazon Bedrock Prompt Flows

A Bedrock builder to visually link prompts, FMs, knowledge bases, and Lambda into GenAI workflows. Promote via working draft → immutable version → alias, with branching and sequential chains.

Amazon Bedrock Prompt Management

A Bedrock capability to create and test prompts as parameterized templates and manage/deploy them via versions and aliases—treating prompts as versioned, comparable, reusable assets.

Amazon CloudFront

A CDN that caches content at edge locations for low-latency delivery to users.

Amazon CloudWatch

The observability core: Logs aggregates logs (query with Logs Insights); metrics are numeric time-series (including custom); alarms notify/auto-respond on threshold breaches (SNS/Auto Scaling). Lambda logs flow to Logs automatically.

Amazon CodeGuru

Assists code quality. CodeGuru Reviewer (flagging defects/secrets in reviews) ended new availability and its capabilities moved into Amazon Q Developer; the current focus is CodeGuru Profiler (identifying runtime CPU/memory hotspots).

Amazon Cognito

App user auth/authorization. User pool = sign-up/sign-in (authentication) issuing JWTs; identity pool = exchange tokens for temporary AWS credentials (AWS authorization). Supports external-IdP federation and MFA.

Amazon Comprehend

A task-specific AI service that analyzes text (sentiment, entities, key phrases).

Amazon Data Firehose

Delivers streams to S3/Redshift/OpenSearch with no code. It supports buffering, Lambda transforms, and Parquet conversion, but keeps no retention for replay.

Amazon Data Lifecycle Manager (DLM)

A service that automates creation, retention, and deletion of EBS snapshots and EBS-backed AMIs via policies. It manages scheduled backups and retention, supporting compliance and data protection (lifecycle of encrypted snapshots).

Amazon DataZone

Provides org-wide data catalog, governance, and data sharing—discover assets via a business catalog and control access via subscription flows. Its capabilities are being integrated into the next-generation Amazon SageMaker (unified studio).

Amazon Detective

A service that builds an entity behavior graph from GuardDuty/CloudTrail/VPC Flow Logs to investigate the timeline, scope, and root cause of an attack from a finding. GuardDuty does detection; Detective does investigation.

Amazon DevOps Guru

A service that uses ML on operational data (metrics/logs/events) to detect anomalous behavior and operational issues, surfacing causes and remediation.

Amazon DocumentDB

A managed MongoDB-compatible document database, fitting workloads with flexible JSON-like documents.

Amazon DynamoDB

A serverless NoSQL key-value/document DB with a flexible schema and low latency at scale.

Amazon EBS

Block storage—a virtual disk attached to EC2; one volume normally attaches to one instance (io1/io2 support Multi-Attach to several), while one instance can have many volumes. Types include gp3/io2, backed up via snapshots.

Amazon EC2

Virtual servers (IaaS), the most flexible compute where you manage the OS and above; optimize via purchasing options (On-Demand/RI/Savings Plans/Spot).

Amazon ECR (Elastic Container Registry)

A registry that stores and versions container images. Image scanning (Basic/Enhanced = Amazon Inspector integration) detects vulnerabilities, lifecycle policies prune old images, and immutable tags prevent overwrites. It is the deployment source for ECS/EKS.

Amazon ECS (Elastic Container Service)

AWS-native container orchestration: describe containers in a task definition and run them on the EC2 launch type (self-managed) or the Fargate launch type (serverless); scales by task/service.

Amazon EFS

File storage—an NFS file system many EC2 can mount and share.

Amazon EKS (Elastic Kubernetes Service)

Managed Kubernetes: AWS runs the control plane; workers run on EC2 or Fargate. Chosen when you want to keep existing Kubernetes assets/ecosystem (more complex than ECS).

Amazon Elastic Transcoder

A transcoding service that converts media (video) into device-targeted formats. Discontinued on 2025-11-13; the successor is AWS Elemental MediaConvert.

Amazon EMR

A managed big-data platform running Apache Spark/Hadoop/Hive/Presto on clusters. Fits very large custom distributed processing and migrating existing Hadoop/Spark assets (Glue is simpler for lightweight serverless ETL).

Amazon EventBridge

A serverless event bus at the core of event-driven architectures. It ingests events from many sources, filters via rules, and routes to targets like Lambda or Step Functions, loosely coupling services.

Amazon Forecast

A managed ML service specialized in time-series forecasting, predicting future values (demand, inventory, finance) from historical series and related variables without building your own model. Closed to new customers in July 2024; SageMaker Canvas time-series forecasting is the successor.

Amazon Fraud Detector

A managed service that uses machine learning to detect online fraud (fake accounts, fraudulent transactions).

Amazon FSx

Managed file systems: FSx for Windows File Server (SMB/AD), FSx for Lustre (HPC, high-speed), FSx for NetApp ONTAP, and FSx for OpenZFS—chosen by workload.

Amazon GuardDuty

Analyzes logs to detect threats automatically; Security Hub aggregates findings, Inspector scans vulnerabilities, Macie finds sensitive data.

Amazon Inspector

A service that continuously scans and assesses EC2, ECR container images, and Lambda for known vulnerabilities (CVEs). Findings carry severity scores, can aggregate into Security Hub, and can be wired into CI/CD pipelines to block deploys of vulnerable images.

Amazon Kendra

An intelligent search service that queries enterprise documents in natural language; ingests varied data sources via connectors and returns relevant passages (also used as a retrieval layer for RAG).

Amazon Keyspaces

A managed Apache Cassandra-compatible wide-column database. Serverless, it fits workloads using Cassandra’s CQL.

Amazon Lex

A service to build conversational bots (chatbots/IVR) for voice and text; design dialogs with intents and slots and implement logic via Lambda. Same technology as Alexa.

Amazon Lightsail

A simplified, fixed-price offering bundling virtual servers, storage, databases, and load balancers for small workloads.

Amazon Lookout series (Equipment / Metrics / Vision)

Purpose-built anomaly-detection ML services. Lookout for Equipment detects equipment anomalies from sensor data (closed to new customers Oct 2025; discontinued Oct 7, 2026). Lookout for Vision (product defects in images) and Lookout for Metrics (business-metric anomalies) are already discontinued.

Amazon Macie

A service that uses ML to discover and classify sensitive data (PII, credentials, etc.) in S3. It supports data-protection compliance, and findings can aggregate into Security Hub for continuous monitoring.

Amazon Managed Blockchain

A service to create and operate Hyperledger Fabric and Ethereum blockchain networks as a managed service.

Amazon Managed Grafana

A fully managed Grafana. It visualizes and alerts on metrics/logs/traces from multiple data sources (CloudWatch, Prometheus, X-Ray, etc.) in a single dashboard—an observability "visualization" layer without self-managing Grafana.

Amazon Managed Service for Prometheus (AMP)

A managed, Prometheus-compatible metrics ingestion/storage service. You query container-environment metrics (EKS/ECS, etc.) with PromQL while AWS handles scale and retention—commonly paired with Managed Grafana for visualization.

Amazon Mechanical Turk

A crowdsourcing marketplace to dispatch human tasks (data labeling, validation) to many workers, used to create labeled data for ML training.

Amazon MemoryDB

A Redis-compatible, durable in-memory database for ultra-low-latency workloads that also need persistence (ElastiCache is for caching only).

Amazon MQ

A managed message broker compatible with ActiveMQ/RabbitMQ, suited to migrating apps that use standard protocols (JMS/AMQP/MQTT); new decoupling typically uses SQS/SNS.

Amazon MSK (Managed Streaming for Kafka)

Managed Apache Kafka, chosen for migrating existing Kafka workloads or when the Kafka-specific ecosystem is required.

Amazon MWAA (Managed Airflow)

Managed Apache Airflow. Schedules and orchestrates data pipelines via DAGs, fitting cases that leverage existing Airflow assets.

Amazon Neptune

A fully managed graph database optimized for relationship queries (social graphs, recommendations, fraud detection, knowledge graphs), supporting Gremlin/openCypher/SPARQL.

Amazon OpenSearch Service

A managed search engine strong at full-text search and log analytics/observability, visualized via OpenSearch Dashboards (Kibana). Redshift leads for large aggregation analytics; use OpenSearch for search/log use cases.

Amazon Personalize

A managed service providing real-time recommendations powered by machine learning.

Amazon Pinpoint

A multichannel customer-engagement service (email/SMS/push/voice campaigns and analytics). Its end was announced in 2025, with capabilities moving to AWS End User Messaging and SES.

Amazon Polly

An AI service that converts text to natural speech (TTS); offers many neural voices across languages for read-aloud apps and IVR.

Amazon Q

A ready-to-use generative AI assistant for business and coding (Amazon Q Business / Amazon Q Developer).

Amazon QuickSight

A serverless BI dashboard service. Visualizes from Athena/Redshift/RDS sources, accelerated by SPICE (in-memory), with row/column-level security, natural-language Q, and embedding. Its role is visualization—not a query engine itself.

Amazon RDS

A managed relational (SQL) database service supporting MySQL, PostgreSQL, MariaDB, Oracle, and SQL Server engines; AWS handles patching, backups, Multi-AZ redundancy, and read replicas.

Amazon RDS Proxy

A fully managed proxy that pools and shares connections to RDS/Aurora, preventing connection exhaustion for Lambda-heavy apps and shortening failover; integrates IAM auth and Secrets Manager.

Amazon Redshift

A petabyte-scale data warehouse (OLAP) using columnar storage and MPP for fast large aggregations; Redshift Spectrum queries S3 directly, and Serverless removes provisioning.

Amazon Rekognition

A task-specific AI service that analyzes images/video (objects, faces, moderation).

Amazon Route 53

DNS (name resolution) and domain registration, with health checks and routing policies.

Amazon S3

Object storage for images, backups, and assets with high durability, accessed over HTTP(S); optimize cost via storage classes (Standard/IA/Glacier).

Amazon S3 Tables

Managed storage for tabular data in Apache Iceberg format on S3, efficiently queryable from analytics engines (Athena/EMR/Spark) with automatic compaction to optimize tables.

Amazon SageMaker

A managed environment to build, train, and deploy ML models end to end (custom models on your data); JumpStart for trying/fine-tuning prebuilt models.

Amazon Security Lake

A service that automatically centralizes and normalizes security logs/events (to the OCSF standard schema) into an S3 data lake in a dedicated account. It aggregates VPC Flow Logs, CloudTrail, Route 53, and various AWS/third-party security data for cross-source analysis with Athena/OpenSearch.

Amazon SES (Simple Email Service)

A scalable email sending/receiving service for transactional and marketing email with high deliverability and bounce/complaint handling.

Amazon SNS

Publish/subscribe messaging that fans out one message to many subscribers (push-based, 1:many); SNS + SQS forms a fan-out pattern.

Amazon SQS

A fully managed message queue that decouples producers/consumers and buffers work to absorb spikes (pull-based, typically 1:1).

Amazon Textract

A task-specific AI service that extracts text and fields from documents/forms (OCR + structure).

Amazon Timestream

A purpose-built managed time-series database that efficiently stores and analyzes large volumes of IoT/metrics time-series data.

Amazon Titan Text Embeddings

A Bedrock embedding model that converts text into semantic vectors—used in RAG to embed documents/queries; dimensionality and normalization affect retrieval accuracy, cost, and storage. As a rule, embed queries and documents with the same model.

Amazon Transcribe

An AI service that converts speech to text (ASR); used for transcribing calls, meetings, and media, with speaker diarization, custom vocabulary, and real-time or batch modes.

Amazon Translate

A neural machine-translation service that translates text between languages; supports real-time/batch translation and custom terminology for multilingual apps.

Amazon Verified Permissions

A managed service that externalizes application authorization (who can do what). Define fine-grained access control with the Cedar policy language, decoupled from app code for centralized management and auditing.

Amazon VPC

Your private network in AWS; divided into public/private subnets, with traffic controlled by security groups/NACLs.

Amazon VPC IP Address Manager (IPAM)

A service to plan, allocate, track, and monitor IP address space across an organization. It prevents overlapping CIDRs and auto-allocates from hierarchical pools to accounts/Regions.

Ambidextrous management

A management approach that lets a firm pursue two activities of very different character at once: exploitation, deepening the existing business through efficiency and refinement to secure current profit, and exploration, venturing into uncertain new areas. Strategists design how to reconcile the tension, leaning too far into exploitation risks the innovator's dilemma of losing adaptability, while leaning too far into exploration risks losing the profit base, by choosing whether to run both within one organization or separate them into distinct units that top management balances.

Amdahl's law

Amdahl's law states that the maximum speedup from parallelizing a program is bounded by its non-parallelizable (sequential) fraction. With parallel fraction p, speedup asymptotically approaches 1/(1-p) as processor count grows, regardless of how many cores are added. A frequent basis for speedup-estimation calculation questions.

AMI (golden image)

The machine image an EC2 instance boots from; a golden AMI with prebaked OS and software gives fast boot and uniform config. AMIs are per-Region and must be copied to other Regions.

AMI distribution and lifecycle (copy/share/deprecate)

Distributing and aging AMIs: copy (replicate to another Region/account for encryption or DR), launch permissions (share with other accounts), deprecate (discourage new use while existing remains usable), and deregister (make the AMI unusable).

Analyst (built-in agent)

One of Microsoft 365 Copilot’s built-in agents. It analyzes and visualizes raw data, using a code interpreter to help with calculations and report building.

Analytical store

When enabled on a container, transactional data auto-syncs into a columnar analytical copy (HTAP). Queryable directly from Synapse Spark/SQL via Azure Synapse Link for large-scale analytics without impacting operational RU. Distinct from the change feed (which returns change events).

Analytics Hub

A service to securely share/subscribe to BigQuery datasets with other organizations without making copies.

Android Enterprise enrollment types

Android management modes: fully managed (corporate, fully managed), dedicated (single-purpose kiosk), corporate-owned work profile (corporate with work/personal separation), personally-owned work profile (personal with a work container)—chosen by ownership and use.

Annotations

Summarized error/warning displays on the logs that jump to the offending line, aiding failure diagnosis.

Anomaly detection (Power BI)

An analytics feature that auto-detects outliers in a time series and suggests explanations. Different in purpose from forecasting (future estimate).

Ansible (network automation)

A configuration-management tool that declares desired configuration in YAML-formatted playbooks and applies it in bulk to many network devices over SSH or an API without requiring an agent on the device. Modules written in Python absorb per-vendor differences, and the design emphasizes idempotency — running the same playbook repeatedly produces the same result.

Ansoff growth matrix

A framework that organizes growth strategies along two axes, product and market, each either existing or new, into four patterns: market penetration (existing product x existing market), product development (new product x existing market), market development (existing product x new market), and diversification (new product x new market). Strategists use it to judge which growth direction fits the firm's strengths and risk tolerance. Diversification carries the highest risk, and success hinges on finding synergy with existing resources.

Anti-passback

An access-control mechanism that detects and forbids logically inconsistent passages, such as an exit with no matching entry record or a re-entry using the card of someone already inside. It prevents tailgating-style misuse where one card is passed outside for multiple people to enter.

Antivirus detection methods (pattern matching and behavior-based detection)

Pattern-matching (signature-based) detection checks files against a definition (pattern) file recording known malware characteristics; it is highly accurate against known threats but depends on keeping the definition file up to date and cannot detect unknown malware (zero-day) not yet in the file. Behavior-based detection instead monitors what a program actually does, so it can catch unknown malware without relying on definitions, but it can raise false positives by flagging legitimate activity as malicious. In practice the two methods are combined for layered defense.

Antivirus policy (Intune)

An Endpoint security policy type that deploys Microsoft Defender Antivirus settings—real-time protection, cloud-delivered protection, scan schedules—to devices. It focuses specifically on malware detection/removal, including notifications and exclusions; a separate layer from a security baseline or ASR, configuring the detect/remove behavior itself.

Anycast

A communication mode that advertises the same IP address from multiple locations at once, automatically routing traffic to the topologically nearest node. CDNs, DNS, and global load-balancing services use it as the foundation for low latency and high availability.

Apache HTTP Server

A widely used Linux web server (httpd / apache2). It is configured via httpd.conf for virtual hosts, authentication, and access control, and controlled with apachectl / apache2ctl.

Apache Kafka connector (Cosmos DB)

A connector linking Apache Kafka and Cosmos DB to ingest/emit streaming event data in real time—used vs ADF/Synapse pipelines for batch migration.

API Gateway (Google Cloud)

A fully managed API gateway in front of serverless backends (Cloud Run/Functions/App Engine); defined with OpenAPI to handle auth, keys, and monitoring.

API Gateway caching

A per-stage response cache. For a configured TTL it returns a stored response for identical requests instead of invoking the backend (e.g., Lambda), cutting latency and backend load. Cache size is chosen from 0.5GB to 237GB and is billed hourly.

API Gateway features (stages, throttling, integrations)

Stages (dev/prod) separate deployments with stage variables; throttling and caching protect and speed up; Lambda proxy integration and mapping templates transform requests/responses; CORS is configured.

API Gateway stage

A named environment (e.g., dev/prod) bound to a specific deployment of an API. Stage variables let backend targets differ per environment, and canary releases can route a portion of traffic to a new deployment. Each stage can carry its own settings such as throttling and log level.

API Gateway types (REST/HTTP/WebSocket)

REST APIs are feature-rich (usage plans, API keys, request validation), HTTP APIs are low-latency/low-cost and simple, and WebSocket APIs support bidirectional real-time communication.

API keys and usage plans

An API key is a token that identifies a client; alone it does not authenticate, but paired with a usage plan it enforces rate limits (requests per second) and quotas (e.g., monthly caps). Authentication itself is handled separately by a Lambda authorizer, IAM, or a Cognito authorizer.

API Management policies

XML rules controlling API behavior (inbound/backend/outbound/on-error); apply auth (validate-jwt), rate limiting, transformation, caching, and CORS.

API rate limiting and pagination

API rate limiting caps the number of requests allowed per unit of time, rejecting excess requests with a 429 error, which requires the client to retry with backoff. Pagination avoids returning a large result set all at once by capping how many records one response holds and having the client fetch the rest page by page (or token by token). Both are constraints an API consumer must design around.

API request validation (input guarding)

Defense that validates input before calling generative AI—API Gateway request validation/schema checks, length/format checks, and Guardrails input filters—rejecting oversized, malformed, or prompt-injection inputs pre-call. Reduces cost and attack surface.

Apigee

An API management platform to securely publish and manage APIs, centralizing usage metering and access control.

App access control (API access management)

Controls whether Marketplace and third-party connected apps may access Workspace data, limiting access to trusted apps and blocking unverified ones; a layer separate from service on/off.

App attach

An Azure Virtual Desktop app-delivery method (the evolution of MSIX app attach) that packages apps onto storage and mounts them dynamically at logon, letting you update/add apps without rebuilding the image, controlled via user/group assignment.

App configuration policy

A mechanism that pushes app behavior settings (server connection URL, default sign-in domain, feature toggles, etc.) in advance so users don't have to configure them manually. It comes in a managed-device flavor and a managed-app (MAM) flavor; unlike an app protection policy, its role is delivering the app's configuration values themselves, not data protection.

App Control for Business

An allowlist-based application-control feature (formerly Windows Defender Application Control/WDAC) that predefines which apps, drivers, and scripts may run, blocking everything else by default. A zero-trust-leaning control that prevents malware or unapproved software from running at all, with policies deployable from Intune.

App Engine

A fully managed web app platform (PaaS) to publish apps without managing servers, letting you focus on development.

App permission policy

Controls which apps users can use (allow/block by Microsoft/third-party/custom). Distinct from an app setup policy (pin/pre-install).

App permissions and consent (OAuth)

Manages access to enterprise apps via OAuth permission grants. Configure permission scopes and control user vs admin consent to prevent risky delegation.

App protection policy (MAM)

A policy protecting organizational data inside apps via MAM (Mobile Application Management). It sets restrictions like copy/paste out of the app, encryption, an access PIN/biometric, and data-transfer limits to other apps (data protection only). Enrollment is not required, so it applies to apps on unenrolled BYOD, and on offboarding it can selectively wipe only the org data within the app.

App registrations and enterprise apps

An app registration is the blueprint (template) for registering an app in Entra ID. An enterprise application is the service principal—the instance of that registration in each tenant—representing sign-in and permissions.

App Service autoscaling

Adjusts instance count to follow load. Choose rule-based Autoscale (scale on metrics like CPU/memory or schedules) or platform-managed automatic scaling. Balances cost and performance.

App Service configuration (settings, TLS, connections)

Configure app settings/connection strings (injected as env vars), custom-domain TLS/certs, and service connections; secrets can use Key Vault references.

App Service Environment (ASE)

A dedicated, isolated App Service environment integrated into a virtual network, used for sensitive workloads needing network isolation and high scale.

App setup policy

Controls presentation by pinning/pre-installing apps in the user’s bar. Distinct from an app permission policy (controls usability).

App types (Win32 / LOB / Microsoft Store)

A Win32 app is a classic desktop app packaged as .intunewin; a line-of-business (LOB) app is an in-house app; a Microsoft Store app is store-delivered. Deploy by format.

Append queries (Power Query)

A Power Query operation that stacks multiple tables with the same column layout vertically into one table—a row-wise combination equivalent to a SQL UNION. Columns are matched by name even if order differs, though type mismatches can error. Commonly used to combine monthly data files.

Apple Business Manager

Apple's web portal that links organization-purchased Apple devices to any MDM solution—Jamf, Intune, and others—so they auto-enroll and configure via Automated Device Enrollment (formerly DEP) out of the box. It also manages app and book licenses (formerly the Volume Purchase Program/VPP, now integrated into ABM's "Apps and Books"), bringing both devices and apps under centralized corporate management.

Apple Volume Purchase Program (VPP)

A mechanism to bulk-purchase paid/free Apple App Store apps at the organization level, sync them into Intune via Apple Business Manager, and assign/reclaim licenses per device or user. Device-based assignment lets apps be distributed without requiring a personal Apple ID, enabling app deployment on BYOD without compromising personal privacy.

Application controls (IT process controls)

Controls embedded in an individual business system to ensure the accuracy, completeness, and validity of input, processing, and output. Examples include check digits to detect input errors, batch controls (reconciling counts and amounts), input data validation, and error reprocessing management. Auditors assess whether the automated and manual controls built into the business process adequately address the relevant risks.

Application Default Credentials (ADC)

The standard way an app resolves credentials to authenticate to Google Cloud; combine with service accounts or Workload Identity Federation to avoid hardcoded keys.

Application Discovery Service

A pre-migration discovery service that collects on-premises configuration and usage—server CPU, memory, and network dependencies—to feed migration planning.

Application Gateway

A regional L7 (HTTP) load balancer supporting URL path-based routing, listeners, HTTP settings, SSL termination, rewrite rules, and WAF.

Application group

The publishing unit in Azure Virtual Desktop. Two types—desktop app group (full desktop) and RemoteApp group (individual apps)—are published by assigning users/groups and surfaced together via a workspace.

Application Insights

An APM service for apps; collects requests, dependencies, exceptions, metrics, logs, and traces to analyze performance and failures. Part of Azure Monitor.

Application Load Balancer (ALB)

An L7 load balancer supporting host/path-based routing, target groups, sticky sessions, and auth integration (OIDC/Cognito), used to route HTTP apps.

Application masking (app masking)

An FSLogix feature that shows or hides apps per user/group on the same image, giving different audiences different app visibility from one golden image (also useful for license control). Distinct from App attach (dynamic app delivery).

Application Migration Service (MGN)

The workhorse for rehosting on-prem or other-cloud servers to EC2 via agent-based, block-level continuous replication. Validate with test launches and minimize downtime at cutover.

Application security group (ASG)

Groups VM NICs by role (web, db) so NSG rules reference ASG names instead of IPs; reduces IP management and clarifies rules.

Application server (AP server)

The middle tier of the three-tier web model, running application/business logic. It receives requests from the web server and exchanges data with the DB server to produce results.

Appointments with Microsoft Teams

Teams' Virtual Appointments feature, integrated with Bookings. Customers or visitors reserve a time slot in advance and then meet with a staff member via video at that time. It's not limited to one-on-one—it also supports group appointments, SMS notifications, a virtual lobby, and a queue view for staff to manage upcoming/waiting appointments—and it's used to replace in-person visits or counter service with virtual meetings (e.g., bank consultations, retail appointment scheduling).

Approvals (Power Automate)

A common cloud-flow use case: send an approval request and branch on approve/reject; responders can act from Teams or Outlook.

Apps Script

A JavaScript-based automation and extension platform for Google Workspace to build scripts and add-ons across Gmail/Drive/Sheets and more.

AppSheet

Google's no-code app platform to build business apps and automations from spreadsheets and databases; Workspace admins control enablement per OU.

APT (Advanced Persistent Threat)

An Advanced Persistent Threat: a sophisticated, long-running campaign against a specific target that stays hidden while continuing to exfiltrate information over an extended period. It often involves state-sponsored actor groups, and is characterized by persistence and advanced technical capability, unlike a one-off attack.

apt (Debian family)

Repository-based package management on Debian/Ubuntu: apt update refreshes the index (not packages), apt upgrade upgrades packages, plus install/remove/purge. apt-cache searches, apt-file reverse-looks-up which package provides a file (including uninstalled). Repositories are defined in /etc/apt/sources.list.

Architecture pattern

A reusable, proven template for recurring problems in a system's overall structure. Representative examples include layers, client-server, event-driven, microservices, and pipes-and-filters, each with its own strengths, weaknesses, and applicable context. Whereas design patterns address class- and object-level design, architecture patterns address coarser overall structure, which the architect selects against quality-attribute requirements.

Archiving and compression (tar / gzip / bzip2 / xz)

tar bundles files into one archive (create cf / extract xf / list tf); add compression with z=gzip, j=bzip2, J=xz (e.g., tar czf a.tar.gz dir). gzip/bzip2/xz each compress a single file (no bundling). dd copies block by block at a low level.

ARM Cortex series (M/R/A)

A family of ARM processor cores tailored by use case: Cortex-M targets low-power, low-cost microcontroller applications; Cortex-R targets hard-real-time control applications; and Cortex-A targets high-performance, OS-hosting workloads (Linux, Android, etc.). Embedded designers select a series based on real-time requirements, performance needs, and power budget.

ARM template

The foundational JSON format for declaratively describing Azure resource configuration as IaC. Deploying the same template repeatedly converges to the same state (idempotent), with parameter files swapping per-environment values. Deployments are incremental (default) or complete mode—complete mode deletes resources not present in the template, a common gotcha.

ARP

A protocol in IPv4 that resolves the MAC address for a target IP address: it broadcasts an ARP request, and the matching host returns its MAC in an ARP reply; results are cached in the ARP table. In IPv6, NDP serves the equivalent role.

ARP spoofing and countermeasures

An attack that sends forged ARP replies on the LAN to register a wrong IP-to-attacker-MAC mapping in victims' ARP tables, relaying traffic through the attacker (a foothold for man-in-the-middle). The countermeasure is Dynamic ARP Inspection (DAI), which uses a legitimate IP-MAC table built by DHCP snooping to block forged ARP packets.

Array and linked list

Fundamental data structures for holding multiple data items in sequence. An array places elements in a contiguous region and allows immediate O(1) access to any element by index, but inserting or deleting in the middle is costly because subsequent elements must shift. A (linked) list has each element hold a reference (pointer) to the next, so insertion and deletion only require re-linking pointers, but accessing an arbitrary element is O(n) because it must be traversed from the head.

Arrow diagram

A diagram (PERT chart) that represents the sequencing of tasks and their durations using arrows and nodes. Summing the durations along each path allows the critical path and the earliest/latest start and finish dates to be calculated.

Artifact

Stores files (build outputs, test reports) against a run; save with upload-artifact, fetch with download-artifact. Auto-deleted after retention. The standard way to pass files between jobs.

Artifact Analysis

Scanning that detects known vulnerabilities in container images/packages. Distinct from Binary Authorization (deploy-only-if-signed); combine detection with enforcement.

Artifact attestations / provenance

Proves and verifies which workflow/commit produced an artifact; under frameworks like SLSA it strengthens supply-chain integrity and, when verified at deploy time, blocks tampered artifacts.

Artifact Registry

A registry to store and manage container images and language packages; the destination for artifacts built by Cloud Build.

Asset management

Accurately tracking and managing the hardware and software an organization owns, typically via an inventory. Without knowing what you own, patching and vulnerability response inevitably have gaps, so this is a foundational activity underpinning security measures.

Assignee

One or more users assigned as responsible for an issue or pull request. Filterable with the assignee: search qualifier, and used to surface a person's own tasks in notifications and dashboards. Distinct from a reviewer, who is asked to review the change's content rather than own the work item.

Assignment filters

Layered on group assignment to narrow application of a policy/profile to only devices matching attributes (e.g., OS version).

Associative entity

An intermediate entity introduced in an E-R diagram to resolve a many-to-many relationship, holding both original entities' primary keys as foreign keys. It can also carry attributes of the relationship itself (e.g., order date), making it straightforward to implement as a relational table.

AssumeRole

An STS API operation that assumes a specified IAM role to obtain temporary credentials; a trust policy restricts who may assume it. The basis for cross-account and third-party access.

Assurance-type audit

A form of audit whose purpose is to express a level of assurance — a conclusion or opinion — on whether the audited system or internal controls conform to a predetermined criterion. The auditor gathers sufficient and appropriate evidence and reports a clear conclusion on conformity. It differs from an advisory-type audit in that issuing improvement recommendations is not the primary goal.

Assured Workloads

A Google Cloud service to run workloads in a controlled environment meeting regulatory requirements (data residency, personnel controls, sovereignty), used for compliance.

Asynchronous data processing

A pattern in which time-consuming work is handed off via a queue or messaging system to run later, rather than making the requester wait for a response; it decouples processing and improves throughput.

Asynchronous processing (generative AI)

Handling slow generations or large batches by decoupling request/response: enqueue jobs in SQS, process with Lambda workers, and return results via storage/notification. Avoids timeouts, absorbs spikes, and levels cost; combine with Bedrock batch inference.

Asynchronous replication

Replication that acknowledges first and applies to the replica afterward; low write latency but possible loss of not-yet-replicated data on failure. Used by read replicas and cross-Region replication; chosen vs. synchronous by RPO.

at / anacron

at schedules a one-time run (at 23:00, at now + 2 hours; atq lists, atrm cancels; control via at.allow/at.deny). anacron manages daily-or-longer periods by interval and runs jobs missed while powered off after boot (config in /etc/anacrontab).

Athena (partitions/workgroups/CTAS)

Key Athena concepts for SQL over S3: partitioning + columnar formats (Parquet) cut scanned data (and cost); workgroups isolate queries with cost limits and separate billing; CTAS creates a table from results, and Federated Query spans other data sources.

Attachments (control)

A control to attach and view files; placed on a form to attach documents or images to a record.

Attack simulation training

Sends simulated phishing to train users—an educational feature. Different purpose from Threat Explorer (investigating actually delivered threats).

Attack story (incident graph)

A Defender XDR feature that visualizes the chain (intrusion→lateral movement→exfiltration) of complex multistage, multi-domain attacks, letting you grasp the whole picture entity-first—used with Security Copilot summaries.

Attack surface

The sum of all the entry points and paths an attacker could potentially use against a system — running services, open ports, exposed APIs, and user input fields, among others. More of these means a larger attack surface, which hardening (disabling what is not needed) works to shrink.

Attack surface reduction (ASR) rules

Preventive Defender for Endpoint settings that block common attacker techniques (Office spawning child processes, obfuscated scripts, credential theft). Rolled out in stages: audit mode to assess impact, then block mode.

Attack vector

The path or method an attacker uses to intrude on or attack a system or network — a phishing email, a weak password, unpatched software, or a USB drive — the "entry point" for an attack.

Audit evidence (sufficiency and appropriateness)

The information a systems auditor relies on to form an audit opinion. Sufficiency refers to the quantity of evidence, while appropriateness refers to its persuasive power (relevance and reliability); both must be satisfied to reasonably support an opinion. Evidence obtained directly by the auditor, or from sources external to the audited department, is generally considered more reliable than evidence obtained indirectly through the auditee.

Audit log events (Copilot)

A mechanism to track operations like policy changes and access ("who did what, when"); it does not store code content.

Audit log streaming

Continuously forwards the audit log (who/when/what) to external systems like a SIEM for cross-cutting analysis, retention, and early detection.

Audit logs (Fabric)

Logs of who did what and when (access, changes, sharing); reviewed via Purview/admin portal for compliance and investigation.

Audit logs and sign-in logs

Audit logs record user and admin activity; sign-in logs record authentication events. They track who did what and when, used for investigation and troubleshooting.

Audit opinion

The conclusion an auditor states, in an assurance-type systems audit, on the adequacy or effectiveness of the audited internal controls or system, based on the audit evidence obtained. The opinion must be expressed strictly within the scope of the evidence actually gathered; the auditor must not assert conclusions unsupported by, or exceeding the scope of, that evidence. Opinion types include unqualified, qualified, adverse, and disclaimer of opinion, chosen according to evidence limitations and the presence of material deficiencies.

Audit plan

A plan prepared before conducting a system audit, defining the audit's objectives, scope, timing, procedures, and organization. To allocate audit resources effectively, it is often split into a medium/long-term basic plan that prioritizes higher-risk areas and a detailed individual audit plan for each specific audit.

Audit procedure

The general term for the specific techniques and steps an auditor performs to obtain audit evidence. Based on the audit plan, the auditor selects and combines techniques—such as document review, interviews, on-site observation, and CAAT—according to the audit objective, and records the results in the audit working papers.

Audit program

A planning document that specifies which audit procedures will be performed, in what order and manner, to achieve the stated audit objectives. It serves as a practical guide that maintains consistent audit quality even if the assigned auditor changes, and the results of executing it are recorded in audit working papers. The program is built directly from the defined audit scope and objectives.

Audit quality control

A mechanism for ensuring the quality of the audit engagement itself. Through review of audit working papers, an independent quality review, and confirmation of compliance with auditing standards, it ensures that audit procedures are appropriate and that the basis for the audit opinion is sufficient. It helps limit variability in individual auditors' judgment.

Audit report

The document reporting the results of a systems audit to the requester (e.g., management). It records the audit's objective and scope, the procedures performed, findings, improvement recommendations, and the audit opinion. The auditor must clearly distinguish fact-based findings from the scope of procedures actually performed.

Audit risk

The risk that an auditor issues an incorrect conclusion because a material weakness goes undetected. It is modeled as the product of inherent risk, control risk, and detection risk; the auditor adjusts the scope and depth of procedures — thereby the level of detection risk — based on the assessed inherent and control risk so that overall audit risk stays within an acceptable level.

Audit scope and audit objectives

The audit objective states what the audit is meant to confirm — for example, the adequacy of availability controls or the effectiveness of internal controls — while the audit scope defines the boundaries of what is covered, such as the systems, processes, period, and locations included. The auditor first clarifies the objective, then delimits a scope sufficient and necessary to achieve it before planning procedures. A scope misaligned with the objective leaves conclusions inadequately supported.

Audit techniques and auditability

Audit techniques are methods a system auditor uses to gather audit evidence, including interviews, document review, on-site inspection, checklists, and computer-assisted audit techniques (CAATs, which use audit software or test data). Auditability is the property that a system is prepared to undergo an audit — that records of its processing and access (logs and audit trails) are in place.

Audit trail

A traceable record of who did what and when; in AWS, CloudTrail records API calls for tamper detection and incident investigation.

Audit trail

A chronological chain of records that allows a transaction or system process to be traced from its origin to its final result, and back again. Logs, document numbers, and similar linkages let an auditor follow processing bidirectionally—from input to aggregated output or vice versa—to investigate errors or irregularities and confirm the legitimacy of processing.

Audit working papers and review

Audit working papers are documents recording the audit procedures performed and the audit evidence obtained by the auditor. They are the critical record supporting the basis for the audit opinion and must be retained for a specified period after the audit concludes. Review refers to a senior person, other than the preparer, checking the adequacy and completeness of the working papers, one of the mechanisms that assures audit quality.

Audit-log and activity-statistics settings (log_statement/track_functions/track_activities)

The core of audit logging is log_statement, which controls which SQL statements get logged (none/ddl/mod/all). By contrast, track_functions (collecting function-call statistics) and track_activities (whether the currently running query appears in pg_stat_activity) are activity-statistics/monitoring settings, not audit logging in the strict sense, and should be distinguished from log_statement.

Auditor independence

The principle that a system auditor must remain free of interests in the audited department or the system under audit, in order to judge fairly and objectively. It requires both independence in appearance (a position free of any perceived bias to third parties) and independence in mind (a mindset that keeps one's professional judgment free from external influence).

Aurora endpoints (cluster/reader/custom)

Aurora connection targets: the cluster (writer) endpoint for writes (follows failover automatically); the reader endpoint to load-balance reads across replicas; and custom endpoints to group an arbitrary set of instances (e.g., for analytics). Use by purpose.

Aurora features (Serverless / Global Database)

Aurora is a durable DB replicating 6 copies across 3 AZs. Aurora Serverless v2 auto-scales to load, and Global Database replicates to multiple Regions at low latency for DR and reads.

Authentication (AuthN)

Verifying "who you are" (identity); performed before authorization.

Authentication context

A label that requires extra authentication (e.g., phishing-resistant MFA) for specific actions/apps. Combined with Conditional Access and protected actions to enforce "strong auth only for the most dangerous operations."

Authentication factors

Categories of evidence for verifying identity: something you know (password), have (token/phone), and are (biometrics). Combining multiple gives MFA.

Authentication methods (MFA / passwordless)

Means of verifying identity. Methods stronger than passwords alone, such as multifactor authentication (MFA) and passwordless (FIDO2 security keys, Authenticator, Windows Hello).

Authentication methods (trust / md5 / scram-sha-256 / peer)

Common authentication methods specified in pg_hba.conf: trust allows connections unconditionally, md5 and scram-sha-256 are password-based (scram-sha-256 being the more secure default), and peer authenticates using the OS username for local connections.

Authentication VLAN

A mechanism by which a switch dynamically assigns a device's VLAN based on the result of authentication such as IEEE 802.1X. On successful authentication, the port is placed into the business VLAN matching the user's role/permissions; when unauthenticated or on failure, it is automatically placed into a restricted quarantine or guest VLAN with limited access to internal resources or the Internet.

Authenticity

An extended element of information security ensuring that a user, piece of information, or process is genuinely what it claims to be, free of impersonation or forgery. Digital signatures and multi-factor authentication substantiate authenticity. It supplements the core CIA triad (confidentiality, integrity, availability) and appears in exam questions distinguishing the seven security elements.

Authoritative Server and Caching Server

An authoritative server returns official answers for the zones it manages, while a caching server (full-service resolver) receives client queries, recursively queries authoritative servers on the client's behalf, and caches results for their TTL. Separating these roles onto different servers is a foundational defense against DNS cache poisoning.

Authorization (AuthZ)

Deciding "what you can do" once authenticated (permissions); performed after authentication.

Authorization flows (OAuth2/OIDC)

Token-acquisition flows: authorization code flow for interactive users, client credentials flow for daemons/service-to-service; choose by scenario.

Auto attendant

A Teams phone feature that greets inbound calls with an IVR (interactive voice response) menu and routes them to a department, person, or voicemail based on business hours and dialed input. It is assigned a resource account to hold a phone number and configured with after-hours messages and call-flow branching.

Auto Scaling

Automatically adjusts the number of EC2 (and more) with demand or failures (elasticity); combine with ELB for HA.

Auto Scaling capacity settings (min/desired/max)

Auto Scaling group sizing: minimum (floor), maximum (ceiling), and desired capacity (the count to maintain now). Scaling adjusts desired capacity within the min–max range.

Auto Scaling policies and lifecycle hooks

Scaling methods: target tracking (hold a metric at target), step, scheduled, and predictive. Lifecycle hooks insert initialization or draining at launch/terminate.

Auto Scaling scaling policies

Auto Scaling adjustment methods: target tracking (keep a metric at a target—recommended, simplest), step scaling (graded steps by breach size), simple scaling (one adjustment then cooldown), scheduled scaling (time-based), and predictive scaling (ML forecast).

Auto Scaling termination policies

Rules deciding which instances to terminate on scale-in: choose from OldestInstance, NewestInstance, OldestLaunchTemplate (formerly OldestLaunchConfiguration), AllocationStrategy, or Default (ClosestToNextInstanceHour matters little under per-second billing). Scale-in protection can exclude specific instances.

auto_explain

An extension that automatically logs the execution plan of any query whose runtime exceeds a configured threshold (log_min_duration). It lets you inspect the plan of a slow query that occurred in production after the fact, without rewriting the query with EXPLAIN; it must be registered in shared_preload_libraries.

Autofix (Copilot Autofix)

Auto-suggests fixes for detected vulnerabilities that developers review and adopt; since suggestions can be wrong, validate before merging.

Automated backups / point-in-time recovery (PITR)

RDS backups: automated backups allow restore to any point within the retention window (up to 35 days) via PITR (using transaction logs); manual snapshots are taken explicitly and kept until deleted. Restores create a new instance.

Automated cloud flow

A cloud flow triggered automatically by an event (email received, item created); the most common automation pattern.

Automated evaluation pipelines

Automatically computes metrics like groundedness, relevance, fluency, and safety against test data to detect regressions and gate model/prompt changes.

Automated investigation and response (AIR)

A Defender XDR feature that auto-runs an investigation triggered by an alert, identifies affected entities, and proposes/executes remediation (isolate, stop process). Auto vs await-approval is set by the automation level; pending actions are approved in the Action center.

Automatic attack disruption

A Defender XDR feature that, the instant it detects a high-confidence in-progress attack (ransomware, BEC), auto-executes containment (isolate compromised devices, disable compromised accounts). It does not wait for human approval, using XDR cross-domain signals for high confidence.

Automatic dashboard

A dashboard that automatically displays AWS-curated key metrics for each service in use. It provides a default view of service health without needing to build a custom dashboard yourself.

Automatic enrollment (Intune)

A mechanism where a Windows device is automatically enrolled into Intune at the same time it performs Microsoft Entra join (or hybrid join). With auto-enrollment enabled in the MDM authority settings, a user simply signs in and the device comes under management without a manual enrollment step—foundational for bulk deployment of corporate-owned devices.

Automatic Model Tuning (HPO)

Automatically searches hyperparameters. With Bayesian, random, grid, and Hyperband strategies it finds the configuration that maximizes/minimizes the objective metric.

Automatic page refresh

A feature that auto-refreshes a report page at an interval or on events for real-time monitoring, requiring a supported storage mode like DirectQuery.

Automatic tuning (plan forcing)

Azure SQL automatically creates recommended indexes and applies FORCE LAST GOOD PLAN (forcing the last known good plan) on regressions.

Automatic/manual failover (Cosmos DB)

Operations to move the write region in a single-write-region setup. An automatic failover policy moves it by priority on regional failure; a manual failover moves it intentionally for planned maintenance.

Automation level (Defender for Endpoint)

A per-device-group setting in Defender for Endpoint that decides whether remediation actions found by automated investigation (file quarantine, process termination, etc.) are auto-approved and executed, or queued in the Action center awaiting human approval. Leaning fully automatic speeds response but raises the risk of a wrong remediation.

AutoML tasks (tabular/vision/NLP)

Automated ML applies not only to tabular data but also to computer vision (image classification, object detection) and NLP, auto-searching algorithms and preprocessing.

Autonomous AP

An access point that carries its own configuration and radio-control functions and operates independently without relying on a WLC. It suits small sites or standalone deployments, but as the number of APs grows, each must be configured and managed individually, and centralized monitoring or seamless roaming becomes difficult.

Autonumber column

A column that auto-assigns a sequential (often prefixed, unique) number on record creation; used for order/ticket numbers.

Autoscaler

A mechanism that automatically increases or decreases the number of servers in response to load; provided as a cloud service feature to automate scale-out and scale-in.

Autoscaling (scaling plan)

An Azure Virtual Desktop feature that auto-starts/stops session hosts by time of day (ramp-up/peak/ramp-down/off-peak) or load via a scaling plan, optimizing capacity and cost. Distinct from Start VM on Connect (power on one host at connect).

autovacuum

A set of background processes that automatically run VACUUM/ANALYZE once a table's update/delete activity crosses a threshold (e.g. autovacuum_vacuum_threshold). In most cases it greatly reduces the need for manual VACUUM and prevents bloat and stale statistics (heavy-update workloads may still require manual VACUUM).

Availability management (service management)

A management activity aimed at keeping an IT service usable whenever users need it. It designs and monitors measures such as eliminating single points of failure, adding redundancy, and planning maintenance so that availability (uptime rate) meets its targets. Availability is expressed as MTBF ÷ (MTBF + MTTR) and improves by lengthening the interval between failures and shortening repair time.

Availability management (service management)

The activity of designing, measuring, and improving services and configuration items to meet an agreed target availability. Availability is computed from mean time between failures and mean time to repair as availability = MTBF / (MTBF + MTTR); for a series configuration the overall availability is the product of the elements, and for a parallel (redundant) configuration it is 1 - (1 - a) to the power n. Eliminating single points of failure (SPOF) through redundancy is the key design point. The IT service manager monitors the target availability and judges the cost-effectiveness of adding redundancy.

Availability rate

The proportion of time a system operates correctly. Availability = MTBF ÷ (MTBF + MTTR); it rises as time-between-failures grows and repair time shrinks. A core availability metric, also used as an agreed SLA target (e.g., 99.9%).

Availability set (fault/update domains)

Spreads VMs within one datacenter across fault domains (power/network/rack) and update domains (planned-maintenance units) to avoid simultaneous impact from unplanned failures and planned maintenance. Use availability zones for datacenter-level failures.

Availability tests

Periodically accesses an endpoint from outside to monitor uptime and response time (Application Insights). The legacy URL ping test is being retired; standard tests and custom TrackAvailability are current. Alerts on failure.

Availability zone

A physically separated datacenter within a region (independent power/cooling/network); zone redundancy gives high availability.

Availability Zone (AZ)

One or more isolated datacenters within a Region (separate power/cooling/network); spreading across AZs gives high availability.

Availability zones vs sets (SAP HA)

Availability zones place VMs in separate datacenters to tolerate zone (DC) failures; availability sets separate by fault/update domains within one DC. Choose by SAP HA requirements.

AVD Insights

An operational dashboard (a workbook on Azure Monitor) that visualizes Azure Virtual Desktop connection performance, host utilization, and user connection failures. It requires sending data to Log Analytics and differs in role from general Azure Monitor.

AWS (Amazon Web Services)

One of the largest public clouds, offering compute, storage, databases, networking, and more on a pay-as-you-go basis.

AWS Agent Squad

An open-source orchestration framework (formerly Multi-Agent Orchestrator) that coordinates multiple AI agents. A Classifier dynamically selects the best agent from input and history; a SupervisorAgent coordinates them in parallel.

AWS Amplify

A framework and set of services to rapidly build and host frontend/full-stack web and mobile apps, integrating auth, APIs, and storage.

AWS App Mesh

A service mesh that standardizes communication between microservices. It deploys an Envoy proxy as a sidecar to each service, providing observability (metrics, tracing) and traffic control (canary deployments, retries) without changing application code. It reaches end of support on 2026-09-30, with ECS Service Connect and Amazon VPC Lattice recommended as successors.

AWS App Runner

A fully managed service that automatically builds, deploys, and scales web apps/APIs from source code or a container image. It exposes containerized apps without managing load balancers, autoscaling, or certificates—lower operational overhead than ECS/Fargate. In DevOps, the choice for running a simple container web service with minimal ops.

AWS App2Container (A2C)

A migration tool that analyzes existing Java/.NET applications and containerizes them—generating a Dockerfile, ECS/EKS deployment artifacts, and a CI/CD pipeline template. It automates modernizing (containerizing) legacy apps.

AWS AppConfig

A Systems Manager capability to safely deliver app configuration and feature flags, with validation, gradual rollout, and automatic rollback (tied to CloudWatch alarms) to reduce risk.

AWS AppSync

A managed GraphQL (and Pub/Sub) API service that aggregates multiple data sources behind one API, with real-time subscriptions and offline sync.

AWS Artifact

Obtain AWS compliance reports and agreements (ISO/SOC audit artifacts) on demand.

AWS Audit Manager

A service that continuously collects and organizes audit evidence against regulatory frameworks (PCI DSS/HIPAA/SOC 2) to support audit reporting. Its role differs from configuration-compliance evaluation (Config) and finding aggregation (Security Hub).

AWS Backup

Centralized backup across services (EBS/RDS/DynamoDB/EFS, etc.). Backup plans define schedule and retention, with cross-region/cross-account copy and Backup Vault Lock (WORM) to prevent deletion.

AWS Backup Audit Manager

Continuously evaluates whether backups comply with organizational policy (frequency, retention, encryption, cross-Region) and generates compliance reports—detecting unprotected resources and deviations to meet audit requirements.

AWS Batch

A managed service to run and schedule batch computing jobs at scale, automatically provisioning the needed compute (EC2/Fargate/Spot).

AWS Billing and Cost Management

The umbrella for billing and cost management—billing dashboard, cost allocation tags, budgets (Budgets), and cost analysis (Cost Explorer)—to track, allocate, and optimize ML training/inference cost.

AWS Budgets

Sets budget thresholds on cost/usage/RI-SP coverage and alerts on actual or forecast overruns; Budget Actions can auto-apply IAM policies or stop resources.

AWS CDK (Cloud Development Kit)

An IaC framework to author infrastructure in programming languages (TypeScript/Python, etc.) that synthesizes CloudFormation templates. Constructs (L1 = raw CFn, L2 = higher-level, L3 = patterns) enable modular reuse, and CDK Pipelines build self-mutating CI/CD.

AWS Certificate Manager (ACM)

Provisions and auto-renews SSL/TLS certificates for free, integrated with ELB/CloudFront/API Gateway to prevent expiry-related outages; auto-renewal is most reliable with DNS validation (email validation can also auto-renew conditionally).

AWS Chatbot

A service that relays ops notifications and alarms to Slack or Microsoft Teams (now renamed 'Amazon Q Developer in chat applications'). It pushes SNS notifications and CloudWatch graphs into chat and can run approved commands from chat (ChatOps).

AWS CLI

The official tool for operating AWS services from the command line. It manages profiles/credentials and Region settings and is used to automate within shell scripts and CI/CD steps, calling APIs directly as `aws <service> <operation>` with JSON output you can post-process (e.g., with jq).

AWS Client VPN

A managed OpenVPN-based service connecting remote users’ devices securely to a VPC or on-prem. Access is controlled via mutual certificate auth, Entra/AD federation, and authorization rules.

AWS Cloud Adoption Framework (AWS CAF)

AWS guidance to adopt the cloud organizationally, organizing capability gaps and migration plans across six perspectives: business, people, governance, platform, security, and operations.

AWS Cloud Map

A service discovery service that dynamically registers application resources (microservices, databases, etc.) so clients can resolve a logical name to its current location (IP/port/ARN). As ECS/EKS tasks scale in or out, clients keep looking up the latest endpoint by name rather than tracking IPs themselves.

AWS Cloud WAN

A service to centrally manage a global network by policy. A core network with segments (isolated routing domains) unifies multiple Regions, accounts, and on-prem.

AWS CloudFormation

An IaC service that deploys resource groups (stacks) reproducibly from declarative templates (YAML/JSON); change sets preview diffs before apply and drift detection finds divergence from reality. Nested stacks and StackSets modularize and deploy across accounts.

AWS CloudHSM

A service providing a dedicated (single-tenant) hardware security module. Use it for strict requirements—FIPS 140-2 Level 3, your own key hierarchy, or regulations mandating physical key custody. It can also serve as a KMS custom key store.

AWS CloudShell

A pre-authenticated browser shell opened from the Management Console. AWS CLI, common runtimes, and persistent storage are preconfigured, letting you run ops commands and scripts quickly without storing keys locally.

AWS CloudTrail

Records an audit log of API activity (who did what, and when) in the account.

AWS CodeArtifact

An artifact repository centralizing dependency packages (npm/pip/Maven/NuGet, etc.). Public repositories can be set as upstreams to transparently proxy and cache them, unifying internal and public packages behind one endpoint.

AWS CodeBuild

A fully managed build/test service; compiles and tests source per steps defined in buildspec.yml and produces artifacts. Pay-per-use with no build servers to manage.

AWS CodeStar

A way to bootstrap a CI/CD toolchain via project templates and a unified dashboard. Discontinued on 2024-07-31; the successor is Amazon CodeCatalyst (unified DevOps) or configuring individual services in the console.

AWS Compute Optimizer

Uses ML to analyze usage of EC2, EBS, Lambda, Auto Scaling groups, etc., detecting over/under-provisioning and recommending right-sizing. A starting point for cost optimization.

AWS Config

Records resource configuration and evaluates compliance with rules (tracks config changes).

AWS Config rules and remediation

Config rules (managed/custom) continuously evaluate resource configuration for compliance, bundled by conformance packs, with non-compliance auto-remediated via SSM Automation.

AWS Control Tower

Automates setup and governance of multi-account environments. It builds a landing zone and applies guardrails (mandatory/recommended preventive and detective controls) to stand up a best-practice org quickly.

AWS Copilot (CLI)

A command-line tool to build, deploy, and operate containerized apps on ECS/Fargate/App Runner. Declaring a service type (e.g., Load Balanced Web Service) and environments (test/prod) generates the underlying CloudFormation, pipelines, and logging. Unrelated to GitHub Copilot.

AWS Cost Explorer

Visualizes cost and usage over time, by service, and by tag for trend analysis and forecasting; also provides RI/Savings Plans recommendations and reserved utilization/coverage reports.

AWS Data Exchange

A data marketplace to find and subscribe to third-party data products and receive/use them securely on AWS, ingesting external datasets into your analytics.

AWS DataSync

Transfers files and objects over the network—fast, incremental, and integrity-checked—across NFS/SMB/S3/EFS/FSx. Suited to online migration when bandwidth is adequate.

AWS Device Farm

A cloud testing service to test apps on real mobile devices and browsers.

AWS Direct Connect

A network service that connects on-premises infrastructure directly to AWS over a dedicated line. Because it bypasses the public internet, it offers low, consistent latency and stable bandwidth, suiting large data transfers and latency-sensitive workloads. For redundancy, AWS recommends connections from multiple locations or pairing with Site-to-Site VPN as a failover path.

AWS Directory Service

A set of managed directories: AWS Managed Microsoft AD (a full Active Directory), AD Connector (a proxy to existing on-prem AD), and Simple AD (for small scale). Used for domain-joining EC2 and integrating identity for AWS applications.

AWS DMS (Database Migration Service)

A service for database migration and continuous replication. CDC (change data capture) ingests only deltas and syncs without stopping the source DB. Pair with SCT (Schema Conversion Tool) when schema conversion is needed.

AWS Elastic Beanstalk

A PaaS that automates provisioning through deployment from uploaded code; choose a deployment method (all-at-once/rolling/immutable/traffic splitting) and codify settings via .ebextensions.

AWS Elastic Disaster Recovery (DRS)

A DR service that continuously replicates servers to AWS at the block level so you can boot/fail over with low RTO/RPO during a disaster (the successor to CloudEndure DR). It stays in a low-cost staging area normally and recovers at full capacity when needed.

AWS Fargate

A serverless compute engine for ECS/EKS: no EC2 instances to manage (patching, scaling)—you just specify vCPU/memory per task. The default choice to reduce operational overhead.

AWS Fault Injection Simulator (FIS)

A managed chaos-engineering/fault-injection service. You define experiments (CPU stress, instance stop, API throttling, AZ impairment, etc.) as templates with stop conditions (guardrails) to validate resilience in production-like environments—the DevOps "break it to learn" resilience testing.

AWS Firewall Manager

A service that centrally applies and enforces WAF, Shield Advanced, security group, Network Firewall, and Route 53 Resolver DNS Firewall rules across the organization (Organizations), auto-applying to new accounts.

AWS Global Accelerator

Provides two static anycast IPs and gets users onto the AWS backbone from the nearest edge to reach the optimal Region with low latency. It supports TCP/UDP on any port and enables second-scale regional failover based on health checks (no caching). A traffic dial on the endpoint group throttles flow.

AWS Glue

The core of serverless ETL. Crawlers infer schema into the Data Catalog (central metadata shared by Athena/Redshift Spectrum/EMR); ETL jobs transform/cleanse on serverless Spark; Glue Data Quality (DQDL) validates data; job bookmarks prevent reprocessing.

AWS Glue DataBrew

A no-code visual data-preparation tool. Apply 250+ transforms (cleansing, normalization) via GUI and reuse them as recipes.

AWS Glue Studio

A visual authoring environment to build, run, and monitor Glue ETL jobs as a node graph, with the option to edit the generated Spark code.

AWS Graviton (ARM instances)

AWS-designed ARM-based processors offering lower price and higher power efficiency than x86 at comparable performance (helping cost optimization and sustainability). Migrating supported workloads (much of Linux, containers, managed services) improves price-performance.

AWS Health (events / organizational view)

Notifies of AWS-side events affecting your resources (maintenance, outages, scheduled changes, certificate expirations). Integrate via the Health API/EventBridge for automated response, and use the Organizational View to see all accounts centrally.

AWS Health (Personal Health Dashboard)

Notifies events affecting your account (maintenance, issues, deprecations). Today this is the 'Your account health' view of the AWS Health Dashboard (formerly the Personal Health Dashboard); overall status is shown by 'Service health' (formerly the Service Health Dashboard).

AWS Health Dashboard

Shows AWS service health and events affecting your resources (AWS-side status; distinct from Trusted Advisor, which advises on your environment).

AWS HealthLake

A managed health data lake to store, transform, and analyze healthcare data (FHIR format), using NLP to extract information from unstructured medical text.

AWS IAM

Identity and access management—users/groups/roles/policies control "who can do what" with least privilege; roles grant temporary permissions (no keys).

AWS IoT services (Core / Greengrass and others)

Managed IoT services: IoT Core (device connectivity/messaging), Greengrass (edge runtime), Device Defender (security audit), Device Management (fleet management), IoT Events (event detection), SiteWise (industrial data). (Things Graph, 1-Click, and IoT Analytics have been discontinued.)

AWS KMS

A managed service to create, manage, and rotate encryption keys, called KMS keys (formerly known as CMKs/Customer Master Keys). It encrypts data in S3, EBS, etc. and controls key use through IAM and key policies, auditing via CloudTrail. KMS keys come in types such as AWS managed and customer managed keys—the two terms are not synonymous.

AWS Lake Formation

Centralizes data-lake permissions. Grants column/row/cell-level access on Glue Data Catalog tables, applied consistently to Athena/Redshift Spectrum/EMR. LF-Tags (tag-based access control) enable governance at scale by attribute, covering granularity IAM alone struggles with.

AWS Lambda

Serverless (FaaS): event-driven function execution billed only for what runs; no server management.

AWS License Manager

A service to centrally manage software licenses (BYOL—bring your own license). It defines licensing rules to prevent overage and tracks/reports usage based on dedicated hosts or core/socket counts—used for license compliance across an organization.

AWS Management Console

The web console for operating and monitoring AWS resources via a GUI—one of the primary interfaces alongside CLI/SDK/IaC.

AWS Marketplace

A catalog to find and procure third-party software (billed via your AWS invoice).

AWS Migration Hub

A service that centrally tracks migration progress per application, aggregating the status of multiple migration tools to give a view from assessment through completion.

AWS Network Firewall

A managed network firewall that statefully inspects and filters VPC traffic. With domain allow-lists, IPS/IDS, and protocol inspection, it provides more advanced perimeter defense than SGs/NACLs.

AWS Nitro System

EC2’s foundation that minimizes virtualization overhead via dedicated hardware (Nitro cards/security chip) and a lightweight hypervisor—delivering high performance, security (confidential isolation via Nitro Enclaves), and the base for new instances.

AWS OpsWorks

A managed configuration-management service that codified server config (packages, services, deploys) with Chef/Puppet. All stacks reached end of support on 2024-05-26; migrate to Systems Manager (State Manager, etc.) or IaC.

AWS Organizations (consolidated billing)

Groups multiple accounts for consolidated billing (volume discounts, central management) and SCPs for org-wide guardrails.

AWS Partners and support resources

Resources that support adoption and operations: AWS Partner Network (APN) certified partners, AWS Professional Services, AWS Marketplace, and the Knowledge Center/re:Post.

AWS Pricing Calculator

A tool to estimate the cost of a planned architecture before building—enter instance types, storage, data transfer, etc. to get a monthly estimate for comparing options or proposals.

AWS Private Certificate Authority

A managed service for running a private certificate authority (CA) for internal use. It issues private certificates that public ACM cannot, enabling mutual TLS (mTLS) between internal services and use cases like IoT device authentication where a public CA is inappropriate, including building a CA hierarchy.

AWS PrivateLink

A way to connect privately from a VPC to AWS services or another account's services without traversing the internet; traffic stays within the AWS network and avoids public routes.

AWS Proton

An internal developer platform that templatized container/serverless deployments. Closed to new customers and deprecated in late 2024 (existing only); standardize instead via ECS Service Connect or your own IaC templates/Service Catalog.

AWS Resilience Hub

A service to assess and track application resilience. You define RTO/RPO targets; it analyzes the architecture to surface gaps against targets and single points of failure, then offers remediation recommendations and continuous assessment—used to validate DR/availability design.

AWS Resource Explorer

A service to search and discover resources across Regions; by default it searches within a single account, and organization-wide search requires multi-account search setup. Find quickly by tag/type for inventory. Where Resource Groups is about grouping, this focuses on search.

AWS Resource Groups

A feature that groups resources by conditions such as tags, resource type, or CloudFormation stack into one logical collection. Once grouped, they can be targeted together for Systems Manager Automation, Patch Manager, or monitoring dashboards.

AWS SAM (Serverless Application Model)

An extension that lets you write CloudFormation concisely for serverless (Lambda/API Gateway/DynamoDB); its short syntax expands into a CloudFormation template at deploy, and sam local enables local run/test.

AWS SDKs and Tools

Official libraries for calling AWS APIs from each language (Python = boto3, JavaScript, Java, Go, etc.). They handle credential resolution, automatic retries (exponential backoff), pagination, and Region configuration under a common spec—the foundation for operating AWS from apps and Lambda.

AWS Secrets Manager

Securely stores secrets (DB credentials, API keys) with automatic rotation via Lambda. More feature-rich than SSM Parameter Store (rotation, cross-account sharing) and billed per secret/use.

AWS Security Hub

Aggregates findings from GuardDuty, Inspector, Macie, Config, and more in ASFF format and presents compliance scores against CIS and the AWS Foundational Security Best Practices, visualizing security posture.

AWS Serverless Application Repository (SAR)

A repository to find, deploy, and publish prebuilt serverless applications defined with SAM. It lets you share reusable apps/components (functions, APIs, integrations) inside and outside an organization and deploy them in near one-click fashion.

AWS Service Catalog

Publishes approved IT services (CloudFormation products) as portfolios so users self-service-deploy standardized configurations, balancing governance and speed with guardrails.

AWS Shield (Standard/Advanced)

A DDoS protection service. Standard is free and automatic (L3/L4) for all AWS; Advanced (paid) adds L7 protection, 24/7 DRT support, cost protection, and detailed reporting—paired with WAF.

AWS Shield Advanced

Advanced protection against large DDoS attacks: always-on detection, response-team (DRT/SRT) support, cost protection, and WAF integration (Shield Standard is free basic protection).

AWS Site-to-Site VPN

An IPsec VPN connecting on-premises to a VPC over the internet—quick and cheap, with two redundant tunnels per connection. Lower bandwidth than Direct Connect but also used as its backup.

AWS Snow Family

Transports large data offline to AWS on encrypted physical devices (Snowball Edge) when networks are too slow/constrained or deadlines too tight. (The petabyte-scale Snowmobile truck has been retired.)

AWS Step Functions

Orchestrates multi-step workflows as a state machine, declaratively handling branching, parallelism, retries, error handling, and waits to sequence Lambda and other services.

AWS Storage Gateway

A gateway for hybrid access from on-prem to cloud storage: File Gateway (NFS/SMB→S3), Volume Gateway (iSCSI), and Tape Gateway (virtual tape→Glacier).

AWS STS

The Security Token Service that issues temporary credentials; it handles AssumeRole and federation requests and returns short-lived credentials, central to avoiding long-term key distribution.

AWS Support plans

Five tiers: Basic < Developer < Business < Enterprise On-Ramp < Enterprise. 24×7 technical support from Business up; a dedicated TAM at Enterprise, while Enterprise On-Ramp gets a pooled TAM.

AWS Systems Manager (SSM)

A unified toolset to operate fleets at scale without opening SSH/RDP: Run Command (commands at scale), Session Manager (shell without open ports), Patch Manager (patch baselines + maintenance windows), Automation (runbooks for auto-remediation), and Parameter Store (config/SecureString). Requires the SSM agent and an IAM role.

AWS Transfer Family

A managed service for ongoing file exchange with external partners over SFTP/FTPS/FTP against S3/EFS, moving the backend to the cloud while preserving existing transfer protocols.

AWS Transform

A service that uses generative-AI agents to accelerate modernization/migration of legacy workloads (.NET migration, mainframe, VMware, etc.).

AWS Trusted Advisor

Checks/recommends best practices across cost, security, fault tolerance, performance, and service limits (for your environment).

AWS User Notifications

A service to centrally configure and aggregate AWS notifications from multiple sources (CloudWatch alarms, Health, Security Hub findings, etc.) and deliver them to the console, email, and more—improving visibility and reach of security events.

AWS Verified Access

A Zero Trust service that grants secure access to corporate applications without a VPN. It evaluates trust signals (policies) from the identity provider and device on each request, verifying every access.

AWS WAF

A web application firewall that inspects and blocks malicious HTTP requests (e.g., SQL injection, XSS) using managed rules and rate limits; attaches to CloudFront, ALB, and API Gateway.

AWS Well-Architected Framework

Best practices for cloud design, reviewed across six pillars (operational excellence, security, reliability, performance efficiency, cost optimization, sustainability).

AWS X-Ray

Distributed tracing: records the segments/subsegments and latency a request passes through and pinpoints bottlenecks/errors via the service map; samples a subset. Complements logs ("what happened").

AzCopy

A command-line tool for fast bulk copy/upload/download to and from Blob storage/file shares. Supports parallel transfer and resumable checkpoints, better suited to scripting/automation than the GUI Storage Explorer. Authenticates via Microsoft Entra ID or a SAS token.

Azure Advisor

Recommends improvements for your resources across cost, security, reliability, performance, and operations.

Azure AI Content Safety

A content filter that detects/suppresses harmful or inappropriate content; used to operate generative AI safely.

Azure AI Document Intelligence

Extracts structured fields (amounts, dates) from invoices, receipts, and forms (document intelligence).

Azure AI Language

Text understanding: sentiment, entity recognition, key phrases, language detection, summarization, CLU.

Azure AI Search (knowledge mining)

Indexes large document sets for cross-document search (knowledge mining); also a retrieval backend for RAG.

Azure AI services

A family of prebuilt AI capabilities exposed via API (formerly Cognitive Services); used with key + endpoint.

Azure AI Speech

Speech ⇄ text (speech-to-text, text-to-speech) and speech translation.

Azure AI Translator

Translates text between languages.

Azure AI Video Indexer

Extracts insights—speakers, transcripts, faces, labels, sentiment—from videos or live streams.

Azure AI Vision

Prebuilt general computer vision: tags, captions, object detection, OCR (Read).

Azure API Management (APIM)

An API gateway exposing multiple backend APIs through one front door. Policies (XML; inbound/backend/outbound/on-error) apply auth (validate-jwt), rate limiting, transformation, caching, and CORS. Offer to consumers via products and subscriptions (keys), document in the developer portal, authenticate to backends with a managed identity, and store secrets in named values (Key Vault).

Azure App Configuration

A service to centrally manage app settings and feature flags; centralizes config, references Key Vault for secrets, and enables progressive rollout via flags.

Azure App Service

PaaS to host web apps and APIs quickly, with no OS management and easy scaling.

Azure Arc

Manages on-prem/other-cloud servers, Kubernetes, and databases through the Azure management plane (policy/tags/RBAC).

Azure Arc-enabled SQL

Connects on-prem or other-cloud SQL Server to Azure via Azure Arc to centrally manage inventory, assessment, updates, and services like Defender/Purview.

Azure Artifacts

A service centralizing dependency packages (npm/NuGet/Maven/Python) in feeds. It proxies and caches upstream sources (public repos), unifying internal and public packages behind one endpoint.

Azure Automation (runbooks)

A service automating cross-cloud/on-prem operations via PowerShell/Python runbooks. Hybrid Workers enable on-prem execution.

Azure Backup

A managed service that periodically backs up VMs, file shares, SQL/SAP HANA, etc. into a Recovery Services vault. Its purpose is data restore from any recovery point on demand, with encryption, retention policies, and instant restore support.

Azure Backup for SAP HANA

An Azure Backup capability that protects an SAP HANA database with DB-consistent streaming backup. Used for HANA because VM-only backup does not guarantee DB consistency.

Azure Bastion

A managed jump-host service for browser-based (Azure portal) RDP/SSH to VMs without assigning them public IPs, so management ports need not be exposed to the internet—reducing the attack surface. Often combined with Just-In-Time VM access, which opens management ports only when needed.

Azure Blob Storage connector

A connector to read/write files in Azure object storage (Blob); used to store large files. Premium.

Azure Boards

An agile work-tracking service. Decompose work items as Epic → Feature → Story/PBI → Task, prioritize in a backlog, plan in sprints (iterations), and visualize state on a Kanban board with WIP limits. Link work items to commits/PRs/builds for traceability.

Azure Cache for Redis

A fast in-memory cache for offloading reads and storing sessions, using TTL for freshness. The legacy Azure Cache for Redis is being retired; Azure Managed Redis is its successor.

Azure CDN

Caches static content at edge for low-latency delivery. The Microsoft standard profile is current; legacy Verizon/Edgio profiles are being retired. New workloads are recommended to use Azure Front Door (with integrated CDN). Updates apply via purge.

Azure Center for SAP solutions (VIS)

A service that represents an SAP system as a Virtual Instance for SAP solutions (VIS) in Azure and handles deployment, start/stop, and integrated management Azure-initiated. Opposite direction from the LaMa connector (SAP-initiated).

Azure Cloud Shell

A browser-based terminal with Azure CLI and PowerShell, no setup, already authenticated.

Azure Compute Gallery

A service (formerly Shared Image Gallery) that versions custom images and replicates them to multiple regions for large-scale distribution to many VMs/subscriptions. In Azure Virtual Desktop it manages and scales out session-host image versions.

Azure Container Apps

A serverless platform to run containers/microservices without managing Kubernetes; KEDA-based event-driven scaling (scale to zero) and Dapr integration.

Azure Container Instances (ACI)

Run containers simply and one-off without orchestration overhead.

Azure Content Understanding

A multimodal information-extraction service that summarizes, classifies, detects attributes, and extracts entities/tables/images from documents, images, video, and audio.

Azure Cosmos DB

A globally distributed, low-latency, auto-scaling managed NoSQL DB supporting multiple APIs (NoSQL/MongoDB/Cassandra/Gremlin/Table).

Azure Cosmos DB for NoSQL

A globally distributed non-relational database service storing JSON documents (formerly the SQL API). Model from access patterns and query documents with SQL-like syntax. Cosmos DB also offers APIs for MongoDB/Cassandra/Table/Gremlin.

Azure Data Box

A service for offline data transfer to/from Azure via a physical storage device, for datasets too large to move practically over the network. The older offline-transfer offering, Azure Import/Export, stopped accepting new orders after November 2024; Data Box (available in several capacity models) is the current successor.

Azure Data Factory

An ETL/ELT pipeline service for ingesting, transforming, and orchestrating data.

Azure Data Lake Storage Gen2

A data lake for large-scale analytics that adds a hierarchical namespace on top of Blob storage. With directory structure and POSIX-like ACLs, it serves as the storage layer for Synapse/Databricks analytics.

Azure Database for MySQL

A managed relational service for the open-source MySQL engine. The current offering is the Flexible Server, supporting same-zone placement for latency optimization and flexible compute/storage scaling; Azure handles patching, backups, and failover.

Azure Database for PostgreSQL

A managed relational service for the open-source PostgreSQL engine. The current offering is the Flexible Server, supporting availability-zone placement, burstable SKUs, and fine-grained maintenance windows; Azure handles patching, backups, and failover.

Azure Database Migration Service (DMS)

A managed service to migrate databases to Azure SQL. It works with the Azure SQL Migration extension to run online/offline migrations.

Azure Databricks

An Apache Spark-optimized platform for big-data processing and ML; strong for data science.

Azure DDoS Protection

Detects and absorbs DDoS attacks that flood a service, protecting availability.

Azure DNS (public zones)

Hosts a domain’s public DNS records in Azure, providing internet name resolution.

Azure DNS Private Resolver

A managed service brokering DNS resolution between on-prem and Azure; conditional forwarders route specific domains to the right DNS.

Azure Event Grid

Reactive pub/sub delivering discrete events (e.g., "blob created"); subscribe via event subscriptions and react in near real time.

Azure Event Hubs

High-throughput ingestion of large streaming/telemetry; processed in parallel via partitions and consumer groups.

Azure File Sync

A service that syncs on-prem Windows file servers with Azure Files. Cloud tiering moves infrequently accessed files to the cloud to save local capacity.

Azure Files (File storage)

SMB/NFS file shares mountable from multiple machines simultaneously.

Azure Firewall

A managed, stateful network firewall for centralized traffic control.

Azure Firewall rules

Azure Firewall’s three rule types: DNAT rules translate/forward inbound, network rules control L3-L4 by IP/port/protocol, and application rules control L7 by FQDN.

Azure Front Door

A global L7 entry point combining CDN caching, global routing, WAF, and SSL offload to boost availability and performance.

Azure Functions

The flagship serverless (FaaS): event-driven function execution billed only for what runs.

Azure Functions hosting plans

Choosing billing/performance for the runtime: Flex Consumption (current default—fast scale, VNet, always-ready instances), the older Consumption (auto-scale, cold starts), Premium (pre-warmed, VNet), and Dedicated (App Service plan).

Azure Functions triggers

What starts a function—HTTP (request), timer (schedule), Blob/Queue/Event (data ops), webhooks; one trigger per function.

Azure IoT Hub (Cosmos DB integration)

A service that aggregates IoT device telemetry; configuring a custom endpoint routes data into Cosmos DB as one data-movement path.

Azure Key Vault

Securely stores and manages keys, secrets, and certificates so they need not be embedded in apps.

Azure Kubernetes Service (AKS)

Managed Kubernetes for production container orchestration (placement, self-healing, scaling).

Azure landing zone

A blueprint for a scalable, governed Azure environment spanning management groups, subscriptions, policies, networking, and identity, based on the Cloud Adoption Framework enterprise-scale.

Azure landing zone (CAF)

A standardized foundation blueprint based on the Cloud Adoption Framework enterprise-scale. It pre-configures network (hub-spoke), identity, policy, and management, deploying consistent governance along the management group hierarchy.

Azure Load Balancer

A fast regional L4 (TCP/UDP) load balancer; configure public/internal, health probes, and backend pools.

Azure Logic Apps

A service that integrates workflows with no-code/low-code using many connectors. It links SaaS, on-prem, and Azure services via triggers/actions to automate business processes and connect systems.

Azure Machine Configuration

Formerly guest configuration. Codifies guest OS configuration to audit/apply settings and enforce remediation of configuration drift.

Azure Machine Learning

Supports the ML workflow (prepare→train→evaluate→deploy→predict); includes Automated ML (auto-best) and Designer (no-code).

Azure ML compute and data (workspace, cluster, data assets)

The Azure ML workspace centrally manages ML artifacts (data, models, experiments, endpoints) with associated resources (storage/Key Vault/Application Insights/Container Registry). Compute: a compute instance for dev (personal; stop to save cost) and a compute cluster to scale training (autoscale, 0 nodes when idle, low-priority/Spot VMs). Data: a datastore (connection info to Blob/ADLS) and data assets (reusable, versioned references: uri_file/uri_folder/mltable). Trained models are versioned in the model registry. Environments (conda/Docker) pin dependencies for reproducibility. Interact via Studio/Python SDK v2/CLI v2.

Azure ML deployment (online/batch endpoints, traffic split)

Inference is served via endpoints. A managed online endpoint = real-time low-latency (Azure manages infra, autoscale); Kubernetes online = existing AKS; batch endpoint = async scoring of large data on a compute cluster. Place multiple deployments under one endpoint and use traffic split for blue/green (gradual rollout, instant rollback). A deployment needs a scoring script (init/run), an environment, and the right instance type/count (MLflow models may need no inference code). Access via managed identity + key/token auth, with private endpoints if needed.

Azure ML jobs and AutoML/sweep (MLflow, hyperparameter tuning)

Training runs as jobs: command (single script), sweep (hyperparameter search), and pipeline (a DAG of components). Define in YAML (CLI v2)/SDK v2. Tracking uses natively integrated MLflow (log_metric/log_param/log_artifact, autolog) to compare experiments. AutoML auto-searches algorithms/preprocessing from a task and picks via a leaderboard. A sweep tunes hyperparameters with a search space + sampling (grid/random/Bayesian) + early termination (Bandit/median stopping), controlling parallelism/cost via max_concurrent_trials.

Azure ML workspace

The top-level resource that centrally manages ML artifacts (data, models, experiments, endpoints), with associated storage, Key Vault, Application Insights, and Container Registry.

Azure Monitor

The monitoring foundation collecting metrics and logs; feeds Log Analytics (KQL), Application Insights (app monitoring), and alerts.

Azure Monitor Agent (AMA)

The standard log-collection agent (successor to MMA/Log Analytics agents); collection is defined declaratively by data collection rules (DCR). Windows security events via Windows Security Events via AMA, structured device logs via CEF via AMA, generic Syslog via Syslog via AMA.

Azure Monitor for SAP solutions (AMS)

A dedicated solution that ingests SAP-specific internal metrics (SAP HANA, NetWeaver, OS, HA clusters) via providers into an Azure Monitor workspace for integrated monitoring/alerting. Distinct from generic Azure Monitor (infrastructure).

Azure NAT Gateway

Outbound-only NAT for a subnet; provides stable egress and avoids SNAT port exhaustion (does not provide inbound).

Azure NetApp Files

A managed NFS/SMB file storage offering high performance, low latency, and large scale. In Azure Virtual Desktop it is chosen for high-IOPS needs such as FSLogix profiles in large environments; for small–mid, cost-conscious scenarios choose Azure Files Premium.

Azure OpenAI model deployment and PTU

In Azure OpenAI you select and deploy a model exposed as an endpoint. Throughput is pay-as-you-go or stabilized via reserved Provisioned Throughput Units (PTU).

Azure OpenAI Service

Securely access foundation models (GPT) via Azure to build generative AI into your apps (enterprise controls).

Azure Pipelines

A CI/CD pipeline service defined as code (YAML). Composed of stages → jobs → steps, triggered by push/PR/schedule, and reused via templates. Runs on Microsoft-hosted or self-hosted agents.

Azure Policy

Defines/enforces rules (allowed regions, required tags, etc.) that resources must meet and evaluates compliance.

Azure portal and Marketplace

The Azure portal is a web console to manage resources via GUI. Azure Marketplace lets you buy and deploy Microsoft/third-party solutions. A mobile app also monitors/operates resources.

Azure Pricing Calculator

A web tool that estimates the monthly cost of a planned Azure configuration. Enter region, SKU, usage hours, and data transfer to get a per-service cost estimate, useful for comparing designs or drafting proposals; actual billing can differ due to FX rates and real usage.

Azure Private Link / Private Link Service

A platform that brings connectivity to PaaS or your own service onto a private IP inside the VNet. Private Link connects to PaaS (Storage/SQL) via a private endpoint (a NIC with a private IP) without the public path. The PaaS public FQDN CNAMEs to a privatelink zone, and the private DNS zone’s A record resolves it to the private IP (forgetting to link → resolves to public IP, a common mistake). Each sub-resource (blob/file, etc.) needs its own endpoint and zone. On-prem resolution uses a DNS Private Resolver plus conditional forwarders. Private Link Service offers your own service (behind a Standard Load Balancer) to other tenants/VNets via Private Link. Unlike service endpoints, it assigns a real private IP and is reachable from on-prem.

Azure Resource Manager (ARM)

The unified management layer for create/update/delete; all portal/CLI/PowerShell/template requests go through it.

Azure Route Server

A managed service that exchanges routes via BGP between an NVA and Azure, reflecting NVA routes into the VNet without manual UDR updates.

Azure Service Bus

An enterprise message broker supporting ordering, transactions, dedup, and dead-lettering; used for reliable command delivery.

Azure Service Health

Notifies you of Azure-side incidents, planned maintenance, and health (distinct from Advisor, which advises on your resources).

Azure Site Recovery (ASR)

A DR (disaster recovery) service that continuously replicates VMs to another region (or on-prem⇔Azure) and fails over to keep workloads running during a disaster. A test failover validates the procedure without disrupting production, and a Recovery Plan orchestrates startup order across multiple VMs.

Azure SQL authentication/access control and data protection

Authentication: Microsoft Entra (recommended—centralized, MFA/Conditional Access, passwordless via managed identity) and SQL auth. Distinguish logins (server) from users (DB); contained users are preferred in SQL Database. Authorize via fixed/custom roles and GRANT/DENY/REVOKE (DENY wins) for least privilege. Narrow rows with row-level security (RLS) and columns with column-level permissions. Data protection: dynamic data masking (limits display; UNMASK reveals real values) and auditing (log operations to Log Analytics/Storage). Encryption is TDE/Always Encrypted (separate entries).

Azure SQL Database

A fully managed relational PaaS; Azure handles patching, backups, availability. Best for new cloud apps.

Azure SQL Database in Microsoft Fabric

Azure SQL Database integrated inside Microsoft Fabric, tightly tied to OneLake mirroring and Fabric’s analytics experience.

Azure storage account

A container bundling Blob, File, Table, and Queue storage services.

Azure Storage Explorer

A standalone GUI app (Windows/macOS/Linux) to browse, upload, and manage Blob storage, file shares, queues, and tables. Suited to inspecting small amounts of data, manual operations, and quick permission tweaks; use AzCopy for high-speed bulk transfer.

Azure Stream Analytics

A service that processes continuously arriving streaming data in near real time.

Azure support plans

Choose among Basic (free, billing/subscription), Developer (trial), Standard (production), and Professional Direct (business-critical), differing in response time and architecture guidance.

Azure Synapse Analytics

A platform unifying large-scale data warehousing and integrated analytics (SQL, Spark, pipelines). Its capabilities are being integrated into the next-generation Microsoft Fabric, which is recommended for new workloads.

Azure Synapse Link

An integration letting Azure Synapse Spark/SQL query the Cosmos DB analytical store directly, doing analytics (HTAP) without impacting the transactional store (operations). Requires the analytical store to be enabled.

Azure Test Plans and automated testing

Azure Test Plans manages manual/exploratory testing, while pipelines embed unit/integration/UI tests as quality gates and surface results and code coverage. Load testing uses the separate Azure Load Testing service.

Azure Traffic Manager

DNS-based global traffic distribution; routing methods (priority/weighted/performance/geographic) decide which IP is returned (real traffic goes straight to the backend).

Azure Virtual Machines (VM)

IaaS virtual machines; the most flexible compute where you manage the OS and above.

Azure Virtual Network Manager

Groups many VNets as network groups and centrally applies connectivity and security admin rules. Security admin rules are higher-priority rules evaluated before NSGs, enforcing org-wide guardrails teams cannot override.

Azure Virtual Network Manager

Centrally manages connectivity (mesh/hub-and-spoke) and security rules across many VNets, applying config to network groups at once.

Azure Virtual WAN

A large-scale networking service centralizing many sites, VNets, and remote users via a managed hub on the Microsoft backbone. It aggregates VPN, ExpressRoute, and VNet connections; the hub transits, so spokes reach each other without the non-transitivity problem. SKUs: Basic (S2S VPN only) and Standard (full: ExpressRoute/P2S/hub-to-hub/Secured Hub). A Secured Virtual Hub embeds Azure Firewall and uses Firewall Manager to centrally apply policy across hubs. Use hand-built hub-and-spoke for small scale, Virtual WAN for large/global.

Azure VM extension for SAP solutions

A VM extension that provides infrastructure/monitoring data about SAP VMs to SAP. Effectively required to make SAP on Azure supportable; configure it after deployment.

Azure VM Image Builder

A service that declaratively defines an image build in a template and auto-runs customization steps to build session-host images reproducibly—more consistent than manual Sysprep-based creation. Built images are distributed via Azure Compute Gallery.

Azure Well-Architected Framework

Five pillars for evaluating workload design: reliability, security, cost optimization, operational excellence, and performance efficiency—making design decisions with trade-offs in mind.

B-tree index

The most common index type, keeping key values sorted in a balanced tree structure. It performs well for range searches, equality searches, and sorting alike, and is the default index type in most DBMSs. Every update carries a cost to rebalance the tree.

B2B collaboration (Microsoft Entra External ID)

Invites users from external organizations (e.g., partners) as guests, letting them collaborate using their own existing identity. Now unified under Microsoft Entra External ID, invitations and permissions are governed via Conditional Access and cross-tenant access settings. An invited guest is registered as a guest user object within the inviting organization's own tenant and authenticates with their external organization's credentials—no separate tenant is created for the guest.

B2B direct connect

A connection model that enables collaboration through shared channels without inviting external-tenant users as guests—instead, both tenants mutually trust each other via Cross-tenant access settings. The partner signs in with their own tenant identity, and no guest user object is created, distinguishing it from B2B collaboration.

B2C (Azure AD B2C)

CIAM (customer identity and access management) functionality that customizes sign-up/sign-in for consumer-facing apps, offering branded login experiences via social login and custom policies. Legacy Azure AD B2C can no longer create new tenants as of May 2025 and is being consolidated/migrated into Microsoft Entra External ID.

Backpressure

A mechanism where a downstream component signals upstream to slow down when it can't keep up with incoming data, throttling the flow. Used in message queues and stream-processing pipelines to prevent memory exhaustion or cascading failures from a backlog.

Backpropagation

A technique that propagates a neural network's output error backward from the output layer to the input layer, computing each weight's gradient along the way. Paired with gradient descent to update the weights, it's the core algorithm underlying deep-learning training.

Backup

Saving copies of data to a separate location or medium in preparation for data corruption or loss or for equipment failure. Even if trouble occurs, the system can be recovered (restored) from the saved copies. It is considered important to take backups regularly and keep them in a location separate from the originals.

Backup strategy (full, differential, incremental, and the 3-2-1 rule)

A full backup copies all data every time — fastest to restore but slow and storage-heavy to take. A differential backup copies only changes since the last full backup, while an incremental backup copies only changes since the previous backup (full or incremental), making backups faster to take but restoration more complex since multiple backups must be applied in sequence. The 3-2-1 rule states that data should be kept in 3 copies (original plus two copies), on 2 different types of media, with 1 copy offsite; keeping a copy offline is also emphasized as a ransomware countermeasure.

Balance sheet

A financial statement showing a company's assets, liabilities, and net assets as of the balance sheet date. Assets are listed on the left (debit side) and liabilities plus net assets on the right (credit side), with assets = liabilities + net assets always holding. It is used to assess a company's financial position, such as solvency and capital structure. Also called the B/S.

Balanced Tree and Heap

A balanced tree keeps the height difference between left and right subtrees bounded, guaranteeing O(log n) search, insertion, and deletion (e.g., AVL tree, red-black tree). A heap is a complete binary tree satisfying a parent-child ordering property, used to implement priority queues and quickly retrieve the max or min element. Both exploit tree balance to bound worst-case complexity, but a balanced tree targets ordered search while a heap targets extremum extraction.

Barcode scanner

A control that reads barcodes/QR codes with the device camera; quickly enters identifiers for inventory/asset apps.

Bare metal and containers (deployment models)

Bare metal deploys a single OS that owns the hardware with no hypervisor; it assumes no sharing with other workloads and delivers the best performance (its "isolation" is not directly comparable on the same axis as VMs/containers). A virtual machine separates a whole guest OS via a hypervisor — strong isolation but heavy. A container isolates a process while sharing the host OS kernel — moderate isolation, lightweight, with fast startup and good portability. Choose based on the tradeoff among isolation strength, weight, and performance.

Barrier-free

The idea of removing elements that act as barriers for elderly people or people with disabilities so they can use products more easily. Unlike universal design, which aims from the outset to be usable by many, it focuses on eliminating specific barriers for particular users after the fact.

BASE properties

A design philosophy adopted by many NoSQL/distributed systems, contrasted with ACID. It stands for Basically Available, Soft state, and Eventually consistent, prioritizing availability and scalability over strict consistency.

Basic Act on Cybersecurity

A law that establishes the basic principles of the nation's cybersecurity strategy and clarifies the responsibilities of the national government, local governments, and critical infrastructure operators. It is the legal basis for the National center of Incident readiness and Strategy for Cybersecurity (NISC) and forms the foundation of the country's overall cybersecurity policy.

Basic authentication, API keys, and bearer tokens

Three common ways to authenticate an API call. Basic authentication Base64-encodes a username and password into a header — simple but weak. An API key sends a fixed, issued key string in a header or query parameter. A bearer token presents a temporary token issued after authentication (such as an OAuth access token) via an "Authorization: Bearer" header, and its expiry limits the damage if it leaks.

Basic file operations (cp / mv / rm / mkdir)

Core commands to manage files/directories: cp copies, mv moves (renames), rm deletes, mkdir/rmdir create/remove (empty) directories, touch creates empty files or updates timestamps, file identifies type. Directory-wide operations need -r (recursive).

Basics of electrical/electronic circuits (current, voltage, resistance)

Current is the amount of electricity flowing through a circuit, voltage is the force that pushes it, and resistance is how much the flow of current is impeded. Ohm's law (voltage = current × resistance) expresses the relationship among these three, and it is a basic physical law underpinning how hardware works.

Batch endpoint

An endpoint that asynchronously scores large data on a compute cluster. Invoking it starts a batch scoring job.

Batch processing

Processing data in groups on a schedule; tolerates latency, handles large volumes efficiently. E.g., nightly rollups.

BCDR design (backup/disaster recovery)

Designs business continuity and disaster recovery: Azure Backup protects data, Azure Site Recovery does cross-Region replication/failover, and zone redundancy/multi-Region meet RPO/RTO requirements.

BCM (Business Continuity Management)

The broader organizational management activity that not only formulates a BCP but also validates its effectiveness through training and exercises and continuously revises it as the business environment changes. Where a BCP is a static plan, BCM is the ongoing PDCA framework that keeps it current.

BCP (Business Continuity Plan)

A plan of action ensuring that, even if an emergency such as an earthquake or cyberattack occurs, core business operations either continue without interruption or are restored within a target time. It predetermines which operations to prioritize for continuity/recovery and the IT assets needed to support them.

Bedrock agent tracing

A capability that records and visualizes an agent reasoning steps for auditing, debugging, and transparency about why it reached a conclusion.

Bedrock data privacy

In Bedrock, your inputs/outputs are not used to train the base models by default and data stays within your account. Connect privately via VPC endpoints (PrivateLink) without traversing the internet, encrypt with KMS, and audit with CloudTrail—foundational for generative AI on sensitive data.

Bedrock foundation models (providers)

Amazon Bedrock offers foundation models from multiple providers via one API: Anthropic Claude, Amazon Titan/Nova, Meta Llama, Mistral, Cohere, Stability AI—chosen by use case.

Bedrock Guardrails

Applies safety controls to generative-AI input/output: denied topics, content filters, PII masking, and contextual grounding checks to suppress harmful/inappropriate responses.

Bedrock inference modes (on-demand/provisioned)

On-demand bills per use; provisioned throughput reserves capacity (model units) for stable, large-scale, low-latency inference. Inference on custom/fine-tuned models generally requires provisioned throughput (on-demand support is model-dependent).

Bedrock model customization

Adapting a foundation model with your data: fine-tuning (labeled data) and continued pre-training (large unlabeled data), both producing a private custom model.

Bedrock Model Evaluations

An Amazon Bedrock capability that systematically compares multiple models or prompt configurations using automated metrics (accuracy, toxicity, robustness, etc.) or human evaluation. Used as a pre-production benchmark to select the best model or parameters for a use case.

Bedrock Model Invocation Logs

A logging capability that records each Amazon Bedrock request/response to S3 or CloudWatch Logs for detailed quality analysis and auditing.

Bedrock streaming (InvokeModelWithResponseStream)

A streaming API that returns generated tokens incrementally, so output appears from the first token without waiting for the full response—improving perceived latency (time to first token, TTFT). Enhances UX for chat UIs and long generations.

Benchmark

A method, or its resulting metric, for quantitatively measuring and comparing the performance of a system or component using standardized workloads or test programs. Examples include TPC benchmarks for transaction processing and SPEC benchmarks for CPU and computation, allowing performance differences between machines or configurations to be evaluated under identical conditions. The architect uses benchmark results as evidence for product selection and design validation, while noting differences from the actual workload profile.

Best, corroborative, and indirect evidence

Three grades of evidence in forensic investigation. Best evidence is the original or direct physical evidence, carrying the highest reliability. Corroborative evidence is additional evidence that backs up another piece of evidence. Indirect (circumstantial) evidence does not show a fact directly but lets it be inferred from the circumstances; on its own it is weak and needs to be weighed alongside other evidence.

BeyondCorp

Google implementation of zero trust that grants access based on verifying user and device rather than network location.

BFF (Backends for Frontends)

A pattern that provides a dedicated backend for each frontend type (Web, mobile, etc.), aggregating and shaping data into the form best suited to that client's screen. Confining each frontend's needs to its own layer keeps a shared API from bloating per screen and lets round trips and payload size be tuned to the device. It poses the architect's judgment of where to place API-aggregation responsibility.

BGP (path-attribute selection)

A path-vector protocol for routing between autonomous systems (AS). Rather than OSPF cost sums or RIP hop counts, it compares multiple path attributes (local preference, AS_PATH length, origin, MED) in a defined priority order, selecting routes that reflect inter-provider contracts and policy.

BGP and route propagation

The standard protocol for dynamically exchanging routes between on-prem and the Azure gateway. Peers are identified by ASN; the Azure gateway’s default ASN is 65515 and on-prem sets its own. Enabling BGP on a VPN auto-learns on-prem subnet changes, removing UDR edits. ExpressRoute always exchanges routes via BGP (private/Microsoft peering). Reflecting learned routes into the VNet is route propagation; disabling it on a route table lets UDRs reliably win. With multiple routes to the same destination, ExpressRoute is preferred over VPN (basis for backup-VPN designs). Precedence: longest-prefix match, then UDR > BGP > system.

BGP path control (AWS)

Controls hybrid routing over Direct Connect/VPN via BGP attributes. AS-PATH prepending de-prioritizes a path, local preference sets outbound preference, and BGP communities control route advertisement scope.

BI Engine and materialized views

BI Engine accelerates BigQuery analytics in memory; materialized views precompute common aggregations. Distinct means to speed dashboards (combinable).

Bias (generative AI)

The risk that training-data skew is reflected in output; check for fairness.

Bicep

A DSL offering more concise syntax than ARM template JSON. Running az bicep build compiles it into an equivalent ARM template JSON, which is what actually gets deployed. Modules and loop syntax improve readability and reuse.

Bidirectional Forwarding Detection (BFD)

A protocol that quickly detects failures between adjacent routers; on ExpressRoute it speeds BGP convergence and failover.

BigLake

A storage engine that lets BigQuery uniformly access data (e.g., in Cloud Storage) without moving it, bridging the lake and warehouse.

BigQuery

Google Cloud serverless data warehouse for fast SQL analytics on petabyte-scale data.

BigQuery Data Transfer Service

A managed service that schedules loads from SaaS or other data warehouses into BigQuery; distinct in purpose from Database Migration Service (DB migration).

BigQuery Editions and reservations

A way to secure compute capacity for steady use at predictable cost; on-demand suits small or irregular usage.

BigQuery ML

A capability to create ML models and run predictions with only SQL on data in BigQuery, without moving the data.

BigQuery ML model types

Models you can train/predict in SQL when data is in BigQuery: classification/regression, ARIMA_PLUS for time-series, matrix factorization for recommendations, boosted trees (XGBoost) for high-accuracy tabular, autoencoders for anomaly detection—chosen by problem.

Bigtable

A wide-column NoSQL database for huge-scale, low-latency workloads such as IoT and time series.

Billing account and budgets

The unit that pays costs; link projects to it (one account, many projects). Budgets and alerts only notify at thresholds and do not auto-stop spending.

Billing alarm

A mechanism that sets a threshold on CloudWatch's EstimatedCharges metric to catch unexpected charges early. Because that metric is recorded only in us-east-1 (N. Virginia), the billing alarm itself must also be created in us-east-1.

Billing model (annual/monthly commitment)

The combination of payment cadence and commitment term for a subscription. An annual commitment paid monthly incurs an early-termination fee if canceled mid-term, while a monthly commitment costs more per seat but is flexible; under CSP, the New Commerce Experience (NCE) makes this choice explicit.

Binary Authorization

Verifies signatures of deployed container images, allowing only trusted (provenance-assured) artifacts onto GKE/Cloud Run; used for supply-chain protection.

Binary number

A way of representing numbers using only the two digits 0 and 1. Because a computer's internals correspond to the on/off states of electrical signals, binary is the basic representation used internally; converting between binary and decimal is a fundamental skill tested.

Binary search

A search method for a sorted list of data that compares the target value with the value at the midpoint of the search range and repeatedly narrows the range by half. It requires the data to already be sorted, and it finds the target faster than a linear search.

Binning (Power BI)

A Power BI/Power Query feature that manually splits a numeric or date field into fixed-width or custom-boundary bins, e.g., to create age brackets or price tiers for aggregation. The boundaries are explicitly chosen by the user, in contrast to clustering, which auto-groups similar data points.

Biometric authentication

An authentication method that verifies identity using physical traits (biometric information) such as fingerprints, face, iris, or veins. It serves as the inherence factor in multi-factor authentication. Its accuracy is measured by the false rejection rate (FRR), the rate of wrongly rejecting the legitimate user, and the false acceptance rate (FAR), the rate of wrongly accepting an impostor; the two are in a trade-off relationship.

Bitmap index

An index type that keeps a bit string per distinct column value (a 1 marking matching rows). It excels on low-cardinality columns such as gender or prefecture, evaluating AND/OR conditions quickly via bitwise operations — good for analytical queries but poorly suited to frequently updated columns.

Black-box testing

A testing technique that verifies from the outside whether a program produces the output specified by its requirements for a given input, without regard to internal structure, using test-case design techniques such as equivalence partitioning and boundary value analysis.

Blast radius

The scope of impact from a failure, mistake, or breach. Kept small via account separation, multiple Regions/AZs, least privilege, and cell-based partitioning. Limiting blast radius is fundamental to resilience and security.

BLE (Bluetooth Low Energy)

A wireless standard that dramatically reduces power consumption compared with classic Bluetooth. Rather than staying continuously connected, a device communicates only briefly when needed and spends most of its time asleep, allowing a coin-cell battery to last for years. Data rates are low, so it suits IoT use cases such as wearables and sensors that send small amounts of data intermittently.

Blob access tiers

Cost-optimization tiers by access frequency: hot (frequent), cool (infrequent), cold, and archive (rarely accessed, slow to rehydrate).

Blob lifecycle management

Policies that auto-move blobs across access tiers (hot→cool→archive) or delete them after N days; optimizes storage cost.

Blob operations with the SDK

Development operations to create/upload/download/list containers and blobs via BlobServiceClient/ContainerClient/BlobClient.

Blob properties and metadata

Setting/getting a blob’s system properties (e.g., Content-Type) and user-defined key/value metadata.

Blob protection (soft delete, versioning, object replication)

Blob/container soft delete recovers from accidental deletion, versioning keeps history, and object replication asynchronously copies to another account.

Blob storage

Storage for unstructured data (objects) such as images, video, and backups.

Blob versioning

A Blob storage protection that automatically keeps prior versions on each overwrite/delete to enable recovery from mistakes, used with soft delete and immutable storage.

Block storage

Low-latency storage the OS mounts as a volume (EBS); suited to databases and boot disks. Most volumes attach to a single instance, but configurations like EBS Multi-Attach allow simultaneous attachment from multiple instances.

Blue ocean strategy

A strategy that avoids fiercely contested existing markets (red oceans) and instead opens up new, uncontested market space through value innovation, raising value while lowering cost at the same time. Strategists use tools such as the eliminate-reduce-raise-create grid to examine which factors of the industry's existing framework to remove, reduce, raise, or add, judging whether differentiation and cost leadership can be pursued simultaneously rather than traded off.

BNF (Backus-Naur Form)

A notation for rigorously defining the grammar of programming languages and similar syntaxes through recursive production rules. Rules are expressed with "::=", replacing the left-hand symbol with a candidate sequence on the right.

Bookmarks (Power BI)

A feature saving the current state (filters/visibility/sort) to build toggles/presentations with buttons and show/hide via the selection pane.

Boot loader (GRUB2)

A program that selects and loads the kernel after firmware; the Linux standard is GRUB2, which offers a menu of kernels and boot options.

Bootloader

A small program that runs first immediately after power-on or reset. After performing minimal hardware initialization, it loads the main firmware image, stored in flash memory or similar, into memory and starts its execution. In OTA update scenarios it often also handles switching between old and new firmware images and rolling back on a failed write, making it directly tied to device reliability.

Bootstrapping

Automatically running initial setup (installing packages, fetching config, starting services) the first time an instance boots; on EC2 done via the user-data script processed by cloud-init.

Botnet

A network of many devices infected with malware (bots) that are controlled together under the command of a C&C server. It is abused as a platform for DDoS attacks, spam distribution, and data theft; infected devices await commands via connect-back communication.

Boyce-Codd normal form (BCNF)

A normal form stricter than 3NF: it requires that every nontrivial functional dependency's determinant be a candidate key, eliminating certain update anomalies (arising when multiple candidate keys exist) that 3NF alone can leave behind.

BPDU Guard

A Cisco feature that immediately puts a PortFast-enabled port into err-disable if it receives a BPDU (an STP control frame), preventing an unintended switch connection on a port meant only for an end host from causing an unexpected topology change or loop.

BPM (business process management)

A management discipline that visualizes, analyzes, and continuously measures and improves business processes. Whereas BPR (business process reengineering) refers to a one-time, radical redesign, BPM is distinguished by running a PDCA cycle to keep raising process efficiency and quality on an ongoing basis. IT strategists use BPM tools to visualize how processes are executing and embed a mechanism for continuous process improvement, aligned with management goals, into business strategy.

BPR (Business Process Reengineering)

An effort that fundamentally re-examines and redesigns business processes, organizational structure, and information systems from the ground up, without assuming existing organizational rules — distinct from incremental improvement (kaizen).

Branch

A movable reference for a parallel line of development; branch a feature off main to work.

Branch prediction

A mechanism that predicts the target of a branch instruction ahead of time so the pipeline is not disrupted when the prediction is correct, preserving throughput. A mispredicted branch triggers a pipeline flush and adds latency, so in real-time embedded control the resulting execution-time variability (jitter) from mispredictions can become a design concern.

Branch protection rule

A setting that enforces required reviews/checks/conversation resolution and can block direct pushes before merge.

Brand strategy

A strategy to build customer awareness, trust, and attachment (brand equity) toward a company's products, services, or the company itself, establishing differentiation that does not rely on price competition and securing sustainable profit. By delivering a consistent message and customer experience, a company accumulates brand value as a source of competitive advantage that is hard for rivals to imitate. IT strategists work to keep the brand experience consistent across all customer touchpoints, including digital channels, and embed how IT contributes to raising brand value into business strategy.

Break-even point

The sales amount (or unit volume) at which total sales exactly equal total cost (fixed cost plus variable cost), producing neither profit nor loss. A lower break-even ratio means a business can turn a profit even with relatively little sales.

Break-even sales

The sales level at which profit is exactly zero. It is computed as break-even sales = fixed cost ÷ (1 − variable cost ratio), where variable cost ratio = variable cost ÷ sales. Actual sales above this level yield a profit and below it a loss; the gap is also used as a measure of a business's margin of safety.

Bridge table (many-to-many)

An intermediate table resolving many-to-many relationships; used instead of a direct many-to-many to avoid double-counting in aggregation.

Bring your own container (BYOC) and ECR

Packaging custom training/inference code as a Docker image stored in Amazon ECR and run on SageMaker, covering needs that built-in algorithms cannot.

Broadcast

A communication mode that sends data to every host on the same network segment at once. Most public-cloud virtual networks (VPC/VNet equivalents) don't support broadcast by default, so on-prem applications built around it typically need a redesign when migrated.

Broadcast Domain

A broadcast domain is the extent to which a broadcast frame can propagate; an entire network (or VLAN) connected via L2 switches forms a single broadcast domain. While an L2 switch segments collision domains, it does not segment broadcast domains—only routers or VLAN segmentation can divide a broadcast domain. A larger broadcast domain means a broader blast radius for broadcast storms.

Broadcast storm

A failure where, with a loop present in an L2 network, broadcast frames (which lack a TTL) circulate and amplify endlessly between switches, spiking CPU usage and congesting links until the network becomes unusable. It is prevented by loop avoidance via STP.

Bronze layer

The first medallion layer; holds raw ingested data nearly as-is (the basis for history/reprocessing).

BSC (Balanced Scorecard)

A management technique that evaluates a business from four perspectives — financial, customer, internal business process, and learning and growth — linking strategic goals to day-to-day operations. Its distinguishing feature is a multi-faceted evaluation that does not rely on financial metrics alone.

Buffer overflow and C2 (command and control)

A buffer overflow writes data past the bounds of an allocated buffer, corrupting adjacent memory to crash a program or run arbitrary attacker code. C2 (command and control) is the post-compromise channel an infected host uses to talk to an external attacker server — receiving remote commands and exfiltrating stolen data.

Build permission

The permission required for other authors to build new reports on a published semantic model. Viewers cannot reuse it.

Building and installing from source

The sequence of obtaining source code (via git clone or extracting a tarball), applying patches if needed, generating build settings with configure, and then compiling and installing with make and make install. It is a way to install software outside of a package manager.

Bulk Support (bulk loading)

A Cosmos DB SDK feature for high-throughput parallel ingest of many items (not atomic)—for migration/bulk loading. Use Transactional Batch when atomic multi-item processing is required.

Bulkhead

A pattern that isolates resources into compartments so overload/failure in one does not spread (named after a ship’s watertight bulkheads). Separating connection pools, threads, queues, or accounts/cells contains impact.

Burn rate

A measure of how fast the error budget (the total allowed amount of unavailability) is being consumed. A faster-than-normal burn rate signals an impending SLO violation, and multi-window alerts (e.g., combining a 1-hour and 6-hour window) are used to catch it early.

Burndown chart

A chart used in agile development that plots remaining work for a sprint or release over time, comparing an ideal line against actual progress. When the actual line diverges from the ideal, it enables early detection of delays or estimation errors, feeding into decisions such as scope adjustment.

Business Critical tier

An Azure SQL service tier delivering low latency and high availability via local SSD and built-in Always On replicas. It includes a secondary for read scale-out.

Business email compromise (BEC)

A scam technique in which an attacker impersonates a business partner or executive by email to trick the target into wiring money to a fraudulent account or disclosing confidential information. Unlike malware-based attacks, it exploits gaps in business processes and manufactured urgency, similar to phishing but narrowly targeted. Requiring multi-person approval and phone verification when changing payment details is a common countermeasure.

Business model canvas

A framework that lays out nine building blocks, customer segments, value propositions, channels, customer relationships, revenue streams, key resources, key activities, key partners, and cost structure, on a single sheet to view and discuss a business model as a whole. Strategists use it, when launching a new business or reviewing an existing one, to quickly check whether the blocks are internally consistent (for example, whether the value proposition and the cost structure actually line up) and as a shared language for discussion among stakeholders.

Business Modeling

An analysis process that visualizes and organizes the flow and structure of the business operations targeted for systemization. Alongside structured techniques such as DFDs (data flow diagrams), flowcharts, and business-flow diagrams, it uses E-R diagrams for data structure and, in object-oriented approaches, UML activity and use-case diagrams. It clarifies business requirements and feeds subsequent data modeling and system design.

Business process flow

In model-driven apps, guides users through stage-by-stage steps (e.g., sales-stage management); distinct from Power Automate flow automation.

Business process modeling

The work of representing the flow of everyday business operations visually with diagrams. Beyond flowcharts, notations such as BPMN (a standard process notation) and DFD (data flow diagram) are used. Sharing who does what and in what order aligns stakeholders, makes waste and problems easier to spot, and serves as a prerequisite for process improvement or systemization.

Business rule

A no-code way in Dataverse to apply logic—require fields, set defaults, validate values, show/hide fields—at the table level, independent of any form.

Business rule (Power Platform)

No-code logic for form show/require/simple validation without code. Not a substitute for a plug-in (server) or client scripting (code).

Button (control)

A control that runs its OnSelect formula when pressed (save, navigate, run a flow); a starting point for actions.

BYOD

The practice of letting employees use their own personal smartphones or laptops for work (Bring Your Own Device). It cuts costs and adds convenience, but creates the risk of devices the organization cannot fully control accessing internal data, so organizations often impose MDM management, app-distribution, and encryption requirements.

BYOK and infrastructure encryption

BYOK (Bring Your Own Key) brings a customer-managed key to storage encryption, and enabling infrastructure encryption adds a second 256-bit AES layer.

CAAT (computer-assisted audit techniques)

An umbrella term for audit techniques that use computers to obtain and analyze audit evidence. It encompasses the test data method, parallel simulation, ITF (integrated test facility), embedded audit modules, and full-population verification with generalized audit software, enabling verification of large data volumes and of program processing logic itself that manual methods cannot practically achieve.

CAB (change advisory board) and ECAB

The CAB (change advisory board) is a standing body that assesses the risk, impact, and schedule of normal changes and advises whether to proceed, bringing together technical, business, and user perspectives to support decisions. The ECAB (emergency change advisory board) is a small, fast-acting formation of just the few authorities needed to approve emergency changes when there is no time to convene the full CAB. The IT service manager designs the CAB agenda criteria and membership and switches to the ECAB in emergencies to balance assessment quality against speed.

Cache (actions/cache)

Saves/restores regenerable data (e.g., dependencies) by key to speed up builds; restore-keys allows partial-match restore. Differs in purpose from artifacts (outputs to keep).

Cache-aside

A pattern: read the cache first, and on a miss fetch from the DB and store it in the cache—speeding subsequent reads.

Caching layer design

Layered caching with CloudFront (edge), API caching, ElastiCache (in front of DBs), and DAX (in front of DynamoDB) to cut latency, backend load, and cost.

CALCULATE function

The core DAX function that modifies filter context to re-aggregate; combined with FILTER/ALL/USERELATIONSHIP for conditional aggregation.

Calculated column (DAX)

A column precomputed per row and stored in the model; unlike a measure it is stored, so it can bloat the model—prefer source-side or measures.

Calculated table

A table generated by a DAX expression; used to create helper tables not in the source, like date or parameter tables.

Calculation group

Applies the same logic (YoY, YTD) across many measures at once; reduces measure duplication and eases maintenance; built in Tabular Editor.

Calendar resources

Registering rooms/equipment in Calendar so they can be booked; Calendar also manages event sharing scope (free/busy visibility).

Call Quality Dashboard (CQD)

Aggregates quality data across many calls/meetings to analyze trends and identify sites/subnets with concentrated quality problems. Distinct from Teams usage reports (which aggregate usage).

Call queue

A Teams phone feature that distributes inbound calls to a group of agents according to a routing method (serial, round-robin, longest idle, etc.), playing hold music or announcements until answered. Assigned a resource account to hold a phone number, it is commonly used as the first point of contact for call centers or help desks.

Calling policies

A policy that controls which calling features a user can use—permitting or blocking outbound calling, call forwarding, delegation, call recording/transcription, etc. on a per-user or per-group basis. It is one of several voice-related policy types alongside voicemail policies and voice routing policy, collectively termed voice policies.

Camera (control)

A control that captures photos with the device camera; used in inspection apps to save images to Dataverse or SharePoint.

CAN (Controller Area Network)

A serial communication standard for automotive and industrial applications in which multiple nodes share a bus over a pair of differential signal lines (CAN_H/CAN_L) with high noise immunity. Messages carry an identifier, and if multiple nodes transmit simultaneously, the message with the lower ID (higher priority) wins arbitration, ensuring high-priority traffic gets through without data corruption even when a collision occurs.

Candidate key and superkey

A superkey is any attribute set that uniquely identifies a tuple. A candidate key is a minimal superkey — removing any attribute from it would break uniqueness. The primary key is the candidate key chosen as the table's representative identifier; the others are called alternate keys.

Canvas app

A Power Apps app type where you place components on a blank canvas to design the UI freely; connects to many data sources (Excel/SharePoint/connectors) with fine control over the look.

CAP theorem

A theorem stating that a distributed system cannot simultaneously fully guarantee consistency, availability, and partition tolerance; when a network partition occurs, it must sacrifice either consistency or availability. It provides the theoretical basis for NoSQL design choices such as adopting eventual consistency.

Capacity

License-tied resource amounts—Dataverse database/file/log storage and API request limits—monitored and allocated in the admin center.

Capacity (Fabric)

Fabric’s compute and billing unit, bought as F SKUs (or Power BI Premium P SKUs) and consuming capacity units (CU); can pause/resume and is bound to workspaces.

Capacity management (three sub-processes)

The activity of planning, monitoring, and tuning the processing capacity a service needs so that it matches demand without shortage or excess, comprising three sub-processes: business capacity management, service capacity management, and component capacity management. Through demand forecasting, threshold monitoring, and trend analysis, it anticipates future capacity shortfalls and reflects them in a capacity plan. The IT service manager, considering the business growth outlook and procurement lead time, judges the timing and scale of upgrades to prevent performance degradation from capacity shortage.

Capacity Management and Bottleneck Diagnosis

Capacity management continuously monitors traffic volume and utilization of links and devices to forecast and plan future upgrades. Bottleneck diagnosis compares utilization, delay, and drop rate across each segment of a path to pinpoint the segment with the highest load relative to capacity (i.e., utilization closest to 1 in queueing terms), narrowing down where reinforcement is needed. Traffic statistics from SNMP or NetFlow typically provide the underlying data.

Capacity Metrics app

An admin app visualizing capacity-unit (CU) consumption and throttling to pinpoint the items causing overload.

Capacity plan

Planning the resources (CPU, memory, storage, server count) needed to accommodate anticipated future load growth; it informs scale-up/scale-out decisions.

Capacity planning / demand forecasting

Estimating future load to plan needed capacity, cost, and scaling policy. In the cloud, Auto Scaling and predictive scaling follow demand dynamically, avoiding fixed over-provisioning; Compute Optimizer and CloudWatch trend analysis feed it.

Capacity Rebalancing

An Auto Scaling group feature that proactively launches a replacement instance as soon as AWS signals an elevated risk of Spot interruption, without waiting for the actual interruption notice. The existing instance is terminated only after the replacement is healthy, minimizing impact on availability.

CapEx (capital expenditure)

Spending to buy and own equipment or facilities up front—like building an on-prem data center—requiring a large initial outlay that is depreciated as an asset over years. It was the center of the traditional pre-cloud IT investment model.

CAPWAP

A tunneling protocol that establishes a tunnel between a lightweight AP and a WLC to carry control information and client data. It sets up separate CAPWAP control tunnels (for control traffic) and CAPWAP data tunnels (for client data).

Carbon Footprint

A tool that visualizes carbon emissions from your Google Cloud usage for sustainability reporting.

Cardinality (relationship)

The row-correspondence multiplicity of a relationship—usually one-to-many (one dimension row to many fact rows); many-to-many needs bridges or careful design. A basic of data model design.

Catalyst Center (formerly DNA Center)

Cisco's centralized management controller for enterprise networks. It unifies automated device discovery and bulk provisioning, SD-Access policy distribution, assurance (health visibility), and a REST API automation entry point into one dashboard. Formerly named DNA Center.

Cause-and-effect diagram (fishbone diagram)

A diagram that organizes the causes of a problem (the effect) into categories such as people, machines, methods, and materials, arranged in a fishbone shape. It is used for root cause analysis and helps ensure the response addresses the true cause rather than just the symptom.

CDN (Content Delivery Network)

A mechanism that caches and delivers content from edge servers geographically close to users, reducing delivery latency caused by physical distance and network path to the origin server. Used for large-scale video/web delivery, it also offloads the origin.

CDP (Cisco Discovery Protocol)

A Cisco proprietary Layer 2 protocol that lets neighboring Cisco devices exchange information such as device type, hostname, IP address, and connected port, letting administrators map the topology. Unlike the vendor-neutral LLDP, it works only between Cisco devices, and is often disabled on ports facing untrusted external connections to limit information disclosure.

Cell production system

A production method in which a small number of workers (one to a few) handle an entire sequence of operations, from parts assembly to inspection, within a U-shaped work area called a cell. Unlike conveyor-belt line production, it allows quick product changeovers and copes well with high-mix, low-volume manufacturing and demand fluctuation, and cross-training workers across tasks can also boost motivation. IT strategists judge whether line production or cell production better fits a company's production strategy based on demand volatility and the breadth of product variation.

Cellular communication

The wireless communication method provided by mobile phone networks. Unlike Wi-Fi, which uses unlicensed spectrum, cellular communication uses licensed spectrum allocated by the government to a carrier, communicating through base stations (cells) that cover a wide area.

Centralized egress and egress-only IGW

Consolidates internet egress into one VPC, sharing NAT gateways via TGW to cut cost. For IPv6, an egress-only internet gateway allows outbound only.

Centralized logging (log archive account)

A best practice of aggregating organization logs (CloudTrail, Config, VPC flow logs, app logs) into S3 in a dedicated log archive account, with tamper-proofing (Object Lock) and long-term retention. Control Tower’s landing zone provisions this by default.

Centralized vs. distributed processing

Centralized processing concentrates processing and data on one core system, making management and consistency easy but creating a single point of failure and a hard performance ceiling. Distributed processing spreads work across multiple nodes to raise availability and scalability at the cost of more complex communication, consistency, and operations. The architect balances the two against reliability requirements, cost, and the operations team's capacity.

Certificate Authority Service (CAS)

Runs a managed private CA to issue/manage internal TLS certificates, reducing the burden of operating your own CA; distinct from a public CA.

Certificate revocation (CRL / OCSP)

Mechanisms to invalidate a compromised certificate before expiry: CRL distributes a revocation list; OCSP queries revocation status online (OCSP stapling improves efficiency). Managed when running a private CA via ACM Private CA (PCA).

Certificate-based authentication (CBA)

Authenticates users with X.509 certificates—a phishing-resistant method; combined with smart cards for high-assurance authentication. A phishing-resistant MFA alongside passkeys (FIDO2).

chage (password aging)

A command to manage password expiry: chage -l shows status, -M 90 sets a 90-day maximum, and -d 0 forces a change at next login.

Chain of custody

An unbroken record of who collected, stored, and handed off each piece of evidence (logs, disk images, and the like) gathered during incident response, and when. A gap in the chain leaves open the possibility of tampering and undermines the evidence's standing in a legal proceeding.

Challenge-response authentication

An authentication method in which the server sends a different random value (challenge) each time, and the client responds with a value (response) computed from the password and that random value. Because the password itself never travels over the network, it resists reuse via eavesdropping (replay attacks).

Change feed

A durable, time-ordered read of item creates/updates in a container (deletes not included by default). Processed via an Azure Functions trigger (serverless) or the SDK change feed processor (parallel via lease) to implement denormalize/referential/aggregation persistence/archiving event-driven.

Change feed (Cosmos DB)

A persistent log of creates/updates in order; used for event processing, materialized views, and syncing to other stores (deletes not included by default).

Change feed estimator

A mechanism that gauges the unprocessed change-feed backlog, informing whether processing keeps up and decisions to scale change feed processor instances. Distinct in role from the processor (which consumes changes).

Change management

A management process for planning, assessing, approving, and recording changes to production so they can be applied safely with minimal impact (ITIL's change management is a representative example). Its core elements are approval workflows, controlling allowed change windows, and having a rollback procedure ready; AWS tools like SSM Change Calendar and Change Manager automate parts of this for AWS workloads specifically.

Change management and configuration management (service management)

Two management processes in IT service operation. Change management plans, evaluates, approves, and records changes to systems or services, carrying them out safely while limiting the associated risk and impact. Configuration management accurately identifies and maintains configuration items (CIs) such as hardware, software, and documents, along with their relationships, in a CMDB (configuration management database), providing input for change-management decisions as well.

Change management controls (program change management)

Controls over the request, approval, testing, migration to production, and recording of each stage of program or system configuration changes. It is a core component of IT general controls, preventing failures or fraud arising from unauthorized changes or insufficient testing. Auditors verify that approval and segregation of duties are embedded throughout the process from change request to production deployment.

Change risk assessment and backout

A control that, before a change is carried out, assesses the risk and impact it poses to the service and to other configuration items, and always prepares a backout (fallback) plan that can reliably restore the pre-change state if the change fails. The backout plan includes the procedure, the time it takes, and decision criteria for when to abort and revert, and its feasibility is confirmed in advance. The IT service manager treats the existence and effectiveness of a backout plan as a precondition for approving a change, protecting the availability of the live service.

Change tracking

A lightweight SQL feature tracking whether rows changed, used for sync and incremental processing. It differs from change data capture (CDC), which retains historical values.

Change types (standard, normal, emergency)

Three categories of change in service management, distinguished by approval route and risk. A standard change is a pre-authorized, low-risk, repeatable change that needs no per-instance approval; a normal change is assessed and approved by the CAB for risk, impact, and schedule; an emergency change addresses an urgent situation such as an outage and is approved quickly by the ECAB, then documented afterward. The IT service manager decides which category each change belongs to, expanding the set of standard changes to reduce approval delay and assessment cost while keeping control.

Channel (publishing target)

Where a built agent is published—Microsoft Teams, your website, other messaging targets.

Channel types (standard / private / shared)

Standard for all team members; private for a limited subset with its own SharePoint site; shared with other teams/external orgs (no team join).

Character encodings and iconv

Ways to represent characters as numbers: ASCII is the 7-bit base for letters/symbols, Unicode assigns numbers to every script with UTF-8 (ASCII-compatible, the Linux default) as its main encoding; ISO-8859 is for European languages, ISO-2022-JP the Japanese email tradition. Convert with iconv -f from -t to (rescuing mojibake).

Chasm

In diffusion-of-innovation theory, a deep gap in demand said to lie between the early market (innovators and early adopters) and the mainstream market (early majority onward). For a new technology or product to win over the pragmatic majority, who value proven reliability rather than novelty, the firm must shift from the marketing and product approach that worked for the early market. Strategists judge which market the product currently sits in and decide on measures to cross the chasm, such as building a track record or narrowing focus to a specific beachhead application.

Check constraint

A constraint that declares, as a SQL expression, a condition a column or row must satisfy; the DBMS rejects inserts or updates that violate it. It lets business rules — e.g., "stock quantity must be zero or more" — be enforced by the database rather than the application.

Checklist method

An audit technique in which the auditor works through a predefined list of check items aligned with the audit objective, verifying each one in turn. It helps prevent omissions and reduces variability between auditors, ensuring coverage and consistency, though it may fail to surface issues not anticipated in the list.

CHECKPOINT

A SQL command that immediately flushes dirty pages to disk and advances the WAL replay starting point. Used to force an immediate checkpoint on demand (e.g., before a backup) rather than waiting for the periodic automatic one. Issuing it too often causes I/O spikes.

Child flows

Child flows in Power Automate that extract shared logic for reuse across flows.

Child process

A process started by another (its parent). When the shell runs a command it forks a child, and only environment variables are inherited (the reason export is needed).

Chirp

Google's generative model family for speech. Originally a multilingual speech recognition (transcription) model; the later Chirp 3 generation also powers HD voice synthesis (text-to-speech).

chmod / umask

chmod changes permissions: octal mode sums r=4, w=2, x=1 per triplet (chmod 754); symbolic mode uses u/g/o/a with +/-/=. umask sets default bits removed at creation—files start from 666, directories from 777 (umask 022 gives 644/755).

Choice column

A column type that limits input to predefined options (formerly option set), preventing variations and keeping data consistent; single or multi-select.

Choosing a data store

Pick by use: lakehouse for Spark/unstructured, warehouse for full T-SQL/transactions, Eventhouse for streaming/time-series.

Choosing a streaming engine

Pick by use: Eventstream for no-code broad connectivity, Spark structured streaming for complex/large processing, KQL for low-latency query aggregation.

Choosing SageMaker built-in algorithms

Choose by task and output type. Tabular classification/regression → XGBoost (gradient-boosted trees robust to missing/scale); Linear Learner for linear/sparse; Factorization Machines for recommendations. Clustering → K-Means, dimensionality reduction → PCA, streaming anomaly detection → Random Cut Forest. Time-series forecasting → DeepAR (one model across many series, probabilistic, strong at cold start); text classification/embeddings → BlazingText (Word2Vec). No-code optimization → Autopilot (AutoML).

Chrome Browser Cloud Management

Centrally distributes Chrome policies (startup pages, sync, Safe Browsing, feature toggles) from the Admin console; differentiate per OU and govern extensions via allow/block + force-install. Distinct from ChromeOS device management of the device itself.

Chunking (splitting strategy)

Splitting documents into smaller pieces (chunks) suited to embedding and retrieval in RAG. Strategies include fixed-size, overlapping, hierarchical, and semantic chunking (splitting at meaning boundaries); size and overlap drive retrieval accuracy and context quality—too small loses context, too large adds noise.

CI/CD

CI (continuous integration) automatically builds and tests code on every change to catch defects early. CD has two meanings: continuous delivery automates everything up to a release-ready state but keeps a manual approval for the production release, while continuous deployment automates all the way to production.

CIA triad

The three pillars of information security: Confidentiality, Integrity, Availability.

CIDR notation

A notation expressing an IP address range by prefix length, like “/24” (256 addresses) or “/16” (65,536 addresses)—the smaller the number, the larger the range. It underlies network design across every cloud: sizing VPCs/VNets and subnets, longest-prefix-match routing, and scoping firewall-rule allows.

CIEM

Cloud Infrastructure Entitlement Management continuously scans identity permissions across Azure, AWS, and GCP to surface and reduce over-provisioned (unused) entitlements. Distinct from PIM, which handles just-in-time privilege elevation—CIEM is an inventory practice that trims the standing permissions themselves.

Circuit breaker

A pattern that temporarily “opens” (cuts off) a repeatedly failing dependency to stop wasteful retries and cascading failure; after a cooldown it half-opens to test, then closes on recovery. Combined with timeouts, retries, and backoff.

CISC and RISC

Two philosophies of CPU instruction set design. CISC has complex, multi-function instructions that do a lot per instruction, often taking several clock cycles each. RISC restricts itself to simple instructions executed in roughly one clock cycle each, using pipelining for speed.

Cisco Catalyst SD-WAN and NSO

Cisco Catalyst SD-WAN (formerly Viptela) is a controller-based SD-WAN solution that centrally manages WAN connectivity between sites, with configuration and monitoring automated through APIs such as Catalyst SD-WAN Manager (formerly vManage). NSO (Network Services Orchestrator) is a multi-vendor tool that declaratively orchestrates configuration across many devices at once using YANG service models and NETCONF.

Cisco Catalyst SD-WAN components (vManage/vSmart/vBond/cEdge)

The four main components that make up Cisco Catalyst SD-WAN (formerly Viptela). vManage (SD-WAN Manager) is the management plane for configuration and monitoring; vSmart is the control plane that distributes routes and policy; vBond handles orchestration, brokering initial authentication and connectivity between the other components; and vEdge/cEdge form the data plane, terminating tunnels and forwarding actual traffic (cEdge is IOS XE-based, while vEdge is the older Viptela OS-based edge router). OMP (Overlay Management Protocol) is what the control plane uses to distribute routes. Note that vManage is now renamed Catalyst SD-WAN Manager.

Cisco SDK

A family of developer libraries that let code call the APIs of Cisco platforms (Meraki, Catalyst Center, ACI, and others) without hand-assembling raw HTTP requests. It absorbs boilerplate such as authentication, pagination, and error handling so the developer can focus on business logic.

Cisco TrustSec (SGT)

A group-based segmentation technology that classifies traffic by a group identifier called an SGT (Security Group Tag) rather than by IP address, defining and enforcing which groups may communicate as centralized policy such as an SGACL. Because enforcement follows group membership, the same policy applies consistently even if a device's IP address or VLAN changes.

CISO (Chief Information Security Officer) and security committee

The CISO is an executive-level role responsible at the management level for an organization's overall information security, linking business strategy to security investment and measures. The security committee is a body, convened under the CISO, in which representatives from each department deliberate on organization-wide policy and coordinate cross-departmental issues, preventing bias or silos from decisions made by a single department. Together they form the core governance structure for driving information security across the whole organization rather than leaving it to one department.

Citizen developer

A non-professional developer who uses business knowledge to build low-code/no-code apps and flows—the primary user Power Platform targets.

Class and instance

A class is a blueprint that defines an object's attributes (data) and operations (methods); an instance is an individual object actually created from a class. Multiple instances can be created from a single class.

Classic VPN

A legacy, single-tunnel IPSec VPN gateway with no SLA guarantee. It comes in route-based (dynamic) and policy-based (static traffic-selector) variants, with the latter kept mainly for compatibility with specific peer network devices. Google deprecates it in favor of HA VPN for new builds.

Classification

A supervised task predicting a category/label (e.g., spam or not).

Clear desk and clear screen

A pair of physical/personnel security controls. Clear desk means locking away documents and storage media instead of leaving them on a desk when stepping away; clear screen means locking the screen when away from the seat so a third party cannot view or operate it. Together they prevent information leaks from shoulder-surfing or theft in the office.

Clickjacking

An attack that overlays an invisible trap frame on a legitimate site to trick users into clicking unintended buttons (transfers, setting changes). Countermeasures include forbidding framing of the site from other domains via X-Frame-Options or CSP frame-ancestors.

Client API object model

A JavaScript API to manipulate model-driven forms via formContext (form/attributes/controls) and executionContext (event info), registered on OnLoad/OnChange/OnSave.

Client-server system (three-tier client-server)

A distributed model that splits functions between clients that request services and servers that provide them. In a three-tier client-server design, the presentation tier (screen), function/application tier (business logic), and data tier (persistence) are separated so each can be deployed and scaled independently. The architect decides which tier runs on which host based on load characteristics and security boundaries.

clone

Copying an existing repository, with its history, to your machine (git clone).

closed network

A carrier-provided private network (L2 wide-area Ethernet or L3 IP-VPN) that does not traverse the public Internet, logically isolated from other subscribers' traffic and typically backed by an SLA for bandwidth and latency. Wide-area Ethernet and IP-VPN services (e.g., MPLS-based) are common implementations.

Cloud (cloud computing)

A model in which IT resources such as servers and software are not owned by the user but rented and used over the internet as needed. Users avoid buying and maintaining equipment and often pay only for what they use. Many familiar services, such as email and online storage, are provided via the cloud.

Cloud App Discovery

Analyzes firewall/proxy logs to discover unsanctioned cloud apps (shadow IT) and assign risk scores. Distinct from app connectors (deep control of connected apps).

Cloud Audit Logs

Audit logs recording who did what and when (admin activity, data access); used for deploy tracking and governance/compliance. Data-access auditing must be explicitly enabled.

Cloud Billing

Links a billing account to projects to track costs, set budget alerts, and export billing data to BigQuery.

Cloud Build

A serverless CI service that automates fetching source, building, testing, and containerizing images. Build steps are defined in cloudbuild.yaml and can be triggered by pushes to GitHub/Cloud Source Repositories; artifacts are typically stored in Artifact Registry.

Cloud CDN

A CDN enabled on an external Application LB backend that caches content at Google's edge; origins include MIG/Cloud Storage/Cloud Run/internet NEG. Drop stale content via cache invalidation on updates.

Cloud characteristics

Core properties of cloud computing: elastic scale, access over the internet, usage-based/subscription billing, and self-healing.

Cloud CLI emulators

Local mocks (Firestore, Pub/Sub, Spanner, etc.) provided by the Google Cloud CLI to speed local development/unit testing without connecting to the cloud (not a production substitute).

Cloud Code

An extension built into IDEs like VS Code and IntelliJ. It helps author Kubernetes manifests and Dockerfiles, deploy to GKE/Cloud Run directly from your local machine, and live-debug on a remote cluster—all from within the editor.

Cloud Composer

Managed orchestration based on Apache Airflow; schedules and runs multi-step pipelines with dependencies.

Cloud computing

Renting computing resources (servers, storage, software) over the internet on demand and paying only for what you use.

Cloud Data Fusion

A managed service to build ETL/ELT pipelines visually with little code.

Cloud Deploy

A managed continuous-delivery (CD) service for GKE, Cloud Run, and Anthos. It templates a delivery pipeline (e.g., dev → staging → prod) and provides deployment strategies like canary or blue-green, approval gates, and rollback as built-in features.

Cloud Digital Leader

The foundational Google Cloud certification testing how to apply Google Cloud products and services to solve business problems.

Cloud DNS

A Google Cloud service that manages internal/external name resolution (domain → IP).

Cloud DNS routing policies and split-horizon

Advanced Cloud DNS resolution: geolocation (vary by source region) and failover (switch to backup on primary failure) routing policies, plus split-horizon DNS resolving the same name differently via public/private zones.

Cloud Endpoints

An API management service that manages OpenAPI/gRPC APIs via the Extensible Service Proxy, adding auth, monitoring, and quotas.

Cloud External Key Manager (Cloud EKM)

Encrypts Google Cloud data using keys held in an external (own/third-party) key-management backend, raising key sovereignty beyond CMEK (customer-managed via Cloud KMS).

Cloud flow

A Power Automate flow that automates cloud services via connector APIs; three kinds by trigger—automated, instant, scheduled.

Cloud flow templates

Prebuilt patterns for common automations (save attachments, notify, approve) so you can start a flow quickly instead of from scratch.

Cloud Functions

A serverless functions service for event-driven small tasks, such as running when a file is uploaded.

Cloud HSM

Protects encryption keys in FIPS 140-2 Level 3 tamper-resistant hardware (HSM); chosen when higher assurance than software keys is required; usable as a CMEK backend.

Cloud IAM

Access management that defines who (member) gets which role (permissions) on which resource; least privilege is the principle.

Cloud Identity

A Google service that manages users and groups and federates external IdPs via SAML SSO and Directory Sync / GCDS.

Cloud IDS

A managed intrusion detection service (IDS) that detects network-layer intrusions and known threat signatures using Packet Mirroring; differs in scope from the cross-cutting Security Command Center.

Cloud Interconnect

A dedicated-connection service (Dedicated/Partner) linking on-premises to Google Cloud with high bandwidth, low latency, and an SLA; choose vs the simpler encrypted-tunnel Cloud VPN by requirements.

Cloud KMS

A managed key-management service to create and manage encryption keys and control rotation/disabling; the basis of CMEK.

Cloud Load Balancing

Choose by use: global external Application LB (L7, routes global users to nearest), internal LB (internal microservices), Network LB (L4, TCP/UDP).

Cloud Logging

A Google Cloud Observability capability for collecting, searching, and retaining logs, used for investigation and audit.

Cloud Monitoring

A Google Cloud Observability capability for metrics monitoring, dashboards, and alerts.

Cloud NAT

A service that lets VMs without external IPs make outbound calls to the internet.

Cloud NGFW and hierarchical firewall

A next-generation firewall controlling in-VPC traffic; offers hierarchical policies inherited by org/folder, an effective policy evaluated by priority, and Enterprise-tier L7 inspection (IPS). Implement micro-segmentation with tags/service accounts.

Cloud PKI (Intune Suite)

An Intune Suite add-on that creates root/issuing CAs in the cloud and automates certificate lifecycle (issuance, renewal, revocation) without building an on-prem PKI. Used together with certificate-delivery profiles for Wi-Fi, VPN, and authentication.

Cloud Router

A router that exchanges routes dynamically over BGP with on-prem/other networks; configure ASN, route priority/MED, and authentication, and control advertised/learned ranges with custom-advertised/learned routes.

Cloud Run

A service that runs containers serverless, scaling to zero when idle and billing only for usage.

Cloud Run revisions and traffic splitting

Each deploy creates an immutable revision; traffic splitting controls the percentage sent to each revision, enabling canary release and rollback.

Cloud Scheduler

A managed scheduler that triggers jobs generically on a time (cron) basis.

Cloud service models (SaaS, PaaS, IaaS)

Three models classified by how much a cloud provider delivers as a managed service: SaaS provides the application itself, PaaS provides the platform to run applications on, and IaaS provides infrastructure such as servers and networking.

Cloud Shell (Google Cloud)

An ephemeral browser-based command-line environment with gcloud and tools preinstalled and already authenticated.

Cloud SQL

A managed relational database compatible with MySQL/PostgreSQL/SQL Server, for typical business apps.

Cloud SQL Auth Proxy

A proxy for secure Cloud SQL connections using IAM auth and encryption without exposing a public IP; the recommended way for apps to connect to the DB.

Cloud Storage

Object storage for unstructured data such as images, video, and backups.

Cloud Storage classes

Classes by access frequency: Standard (frequent)/Nearline (~monthly)/Coldline (~quarterly)/Archive (long-term rare). Less access = cheaper storage but pricier retrieval.

Cloud Trace

A distributed-tracing service that follows request paths (spans) across services to find latency bottlenecks; a different observability axis from metrics (Monitoring) or logs (Logging).

Cloud VPN

A service connecting on-premises or other networks to Google Cloud over an encrypted tunnel.

Cloud Workload Protection (CWP)

Enables per-resource-type Defender plans (Servers, Storage, Databases, Containers, Key Vault, AI) to detect runtime threats—the runtime pillar paired with Defender CSPM (proactive posture).

Cloud Workstations

A managed cloud development environment accessed from a browser or local IDE. Custom container images let teams standardize the dev environment, and workstations can live inside a VPC so source code never touches a personal machine. Billed by usage time, with automatic suspension when idle.

CloudFormation intrinsic functions (Ref/GetAtt/Sub)

Functions that resolve values dynamically in templates: Ref (reference a parameter/resource), Fn::GetAtt (get a resource attribute—ARN, endpoint, etc.), Fn::Sub (interpolate variables into strings), plus Fn::Join/Fn::If, and more. They avoid hard-coding and improve portability.

CloudFormation template anatomy

Key sections of a template: Parameters (inputs), Mappings (env/Region lookup tables), Conditions (conditional creation), Resources (what’s created—required), and Outputs (exports to other stacks). Together they make reusable IaC that absorbs environment differences.

CloudFormation validation (Hooks/Guard/Linter)

Tools for template quality and governance: cfn-lint (syntax/best-practice checks), CloudFormation Guard (cfn-guard) for policy-as-code compliance, and Hooks to enforce custom checks before provisioning—combined with drift detection to maintain control.

CloudFront automatic compression

A feature where CloudFront automatically compresses origin responses with Gzip or Brotli, cutting transfer size and speeding up rendering. It only applies when the origin returns an uncompressed response, the Content-Type is on the compressible (text-based) allowlist such as HTML/CSS/JS, and the object size is between 1,000 and 10,000,000 bytes; it's enabled per cache behavior. CloudFront picks the format (gzip or br) based on the viewer's Accept-Encoding header.

CloudFront cache policy

A setting that defines the TTLs (min/default/max) CloudFront uses when caching an object and which elements (headers, query strings, cookies) are included in the cache key. Narrowing the cache key raises the hit ratio and reduces origin load, trading off against how finely responses need to vary per request.

CloudFront geo restriction

A per-distribution control that allows or blocks delivery using a country-code allow list or deny list. It's used to satisfy content-licensing or export-regulation requirements that are geography-specific. Because it judges location from IP geolocation, it can be bypassed via VPNs.

CloudFront invalidation

An operation that forcibly removes cached content from CloudFront edge locations before its TTL expires (by path), so the next request fetches fresh content from the origin. The first 1,000 paths per month are free, but frequent invalidation adds cost and slight latency, so cache policies or versioned filenames are the generally recommended alternative.

CloudFront origin groups (origin failover)

Bundles a primary and secondary origin and fails over to the secondary on specified error responses—providing origin redundancy by pairing, e.g., S3 with a cross-Region S3 or ALB.

CloudFront origin protection (OAC) and edge functions

Origin Access Control (OAC, formerly OAI) keeps S3 private while allowing access only via CloudFront; it is the current recommendation, supporting SSE-KMS, all Regions, and all HTTP methods. For edge compute, choose by use: ultra-light, viewer-only CloudFront Functions (header tweaks/redirects/URL rewrites) versus Lambda@Edge, which can hook origin events and make external calls.

CloudFront signed cookies

A Cookie-based access restriction used when many files (or a video stream) should be authorized with a single grant. It issues a cookie to the browser rather than modifying the URL itself, so existing application URL structures stay unchanged while access is still restricted.

CloudFront signed URL

A URL that restricts access to a single file by expiry, IP, or a custom policy. Because one signed URL maps to exactly one object, distributing many files (e.g., video segments) means generating one per request; it is signed with a CloudFront key pair or a trusted key group.

CloudTrail advanced configuration

An organization trail centrally records all accounts, log file validation detects tampering, and data events record S3 object/Lambda invocations in detail. CloudTrail Lake enables SQL query analysis.

CloudTrail event types (management/data/Insights)

Management events = control-plane API actions (recorded by default, free). Data events = high-volume data operations like S3 object access or Lambda invokes (opt-in, paid). Insights events detect unusual API call-rate anomalies.

CloudWatch agent

An agent required to collect in-guest OS metrics like EC2 memory usage and disk free space, which are not available by default (a common SOA gotcha); it also collects logs.

CloudWatch alarm states

An alarm has three states: OK (within threshold), ALARM (breached), and INSUFFICIENT_DATA (not enough data—at startup or on missing metrics). Each transition can trigger actions (SNS notify, Auto Scaling, EC2 action).

CloudWatch alarms (composite/anomaly)

Alarms that notify/act when a metric crosses a threshold. Composite alarms combine conditions with AND/OR, and anomaly detection flags deviations from a dynamic baseline.

CloudWatch Contributor Insights

Ranks “top contributors” from logs by rule (e.g., IPs causing the most errors, slowest APIs, most-accessed items)—used to find load skew or anomalous sources.

CloudWatch cross-account observability (OAM)

Via the Observability Access Manager (OAM), aggregates metrics, logs, and traces from multiple source accounts into one monitoring account for centralized observation—simplifying operations in multi-account setups.

CloudWatch dashboard sharing

A feature that securely shares a CloudWatch dashboard with external parties who have no AWS account, or with non-logged-in users. There are three sharing methods: inviting up to 5 specific email addresses (each with their own Cognito-backed password), sharing a single dashboard as a public link with no authentication, and sharing all dashboards in the account via SSO/SAML integration. It lets you provide read-only access—like a status page—without granting IAM permissions.

CloudWatch dashboards and Synthetics

Dashboards visualize metrics/logs on one screen, and Synthetics canaries continuously test endpoint availability and response via synthetic monitoring.

CloudWatch Internet Monitor

A service that visualizes the availability and performance of internet paths between AWS resources and end users, broken down by city and network provider. It draws on AWS's large-scale traffic observations to surface problems visible only from the end-user's vantage point, such as ISP-side outages.

CloudWatch Logs

Aggregates and stores logs: log streams sit under a log group (which sets retention). Metric filters extract numeric metrics from logs, and subscription filters stream logs in real time to Kinesis/Lambda/OpenSearch. Logs from Lambda and many services arrive automatically.

CloudWatch Logs export to S3

A feature that exports logs accumulated in CloudWatch Logs to an S3 bucket for long-term retention, cost optimization (tiering to Glacier), or analysis in another tool. The export runs as a non-real-time batch job; for continuous streaming delivery, a subscription filter to Kinesis Data Firehose is used instead.

CloudWatch Logs Insights

Interactively analyzes logs stored in CloudWatch Logs with a purpose-built query language (fields/filter/stats/sort/limit) to filter and aggregate—e.g., error counts or top IPs. Billed by the volume of data scanned.

CloudWatch Metric Streams

Continuously delivers metrics in near real time to S3 or third parties (e.g., Datadog) via Data Firehose—lower latency and load than polling with GetMetricData for integrating external monitoring.

CloudWatch metrics

The numeric time-series data CloudWatch handles, identified by namespace and dimensions and feeding alarms and dashboards; standard metrics (e.g., EC2) are collected automatically.

CloudWatch Network Monitor

A service that actively probes the network paths of hybrid connectivity between on-premises and AWS (Site-to-Site VPN, Direct Connect), monitoring latency and packet loss. It helps isolate whether a fault lies on the AWS side or the on-premises side.

CloudWatch ServiceLens

A CloudWatch feature that correlates metrics, logs, and X-Ray traces in a single view. It visualizes where latency or errors occur on a service map, speeding up root-cause analysis (RCA) in distributed systems.

CloudWatch Synthetics

A CloudWatch feature that runs canaries (configurable scripts) on a schedule to monitor endpoints and user flows from the outside, mimicking real users. It can detect availability or latency degradation before real traffic is affected, complementing SLA monitoring and health checks.

Cluster

A configuration of multiple servers working in coordination as a single system, built with tools such as Pacemaker and Corosync, raising availability through failover on failure.

CLUSTER

A SQL command that physically reorders a table's rows to match a specified index's order. It improves range-scan locality (correlation) and reduces I/O, but takes an exclusive lock on the table while running, and newly inserted rows do not automatically maintain cluster order afterward.

Cluster directories (pg_tblspc/pg_wal/pg_stat_tmp)

Key directories under the data directory: pg_tblspc holds symbolic links to each tablespace, and pg_wal (renamed from pg_xlog in PostgreSQL 10) holds WAL segment files. pg_stat_tmp held temporary statistics files, but it was retired in PostgreSQL 15 when the cumulative statistics system moved to shared memory (an empty directory may still be created for extension compatibility but is no longer used).

Clustering

An unsupervised task grouping similar items (e.g., customer segmentation).

Clustering (HA cluster, load-balancing cluster)

A technique that binds multiple servers together so they appear as a single system to users. A high-availability (HA) cluster aims to keep running by failing over to other nodes when one fails, while a load-balancing cluster distributes requests across nodes to raise throughput and concurrency. The architect chooses the configuration based on whether availability or performance is the goal, and designs for shared-disk arrangements and split-brain prevention.

CMDB (configuration management database)

The CMDB (configuration management database) records the configuration items (CIs), their attributes, and the relationships among them, serving as the core information base for configuration management. It is used for impact analysis of changes and releases, tracing incident causes, and visualizing service structure, and its value depends on the accuracy and currency of its data. The IT service manager designs the CMDB scope and update process, linking it to change management to prevent drift from reality and thereby securing the reliability of impact assessment.

CNN (convolutional neural network)

A deep learning model that combines convolutional layers and pooling layers to progressively extract spatial features such as those in images. It is a leading architecture for high-performance image recognition and object detection.

COBIT

An IT governance and management framework developed by ISACA that organizes control objectives systematically. Systems auditors use it as a benchmark to judge whether the design and operation of controls at an audited entity are adequate.

Code of conduct

A document defining expected behavior for community participants and how violations are handled; with CONTRIBUTING and a license it supports healthy OSS governance.

Code of ethics

A code of conduct requiring security professionals to act responsibly, in line with laws and organizational policy, and never misuse the information or access their work gives them. The more a role involves offensive techniques such as penetration testing, the more critical it is to stay strictly within authorized scope.

Code review (Pull Request)

Commenting on a diff in a Pull Request and approving or requesting changes; required reviews and CODEOWNERS-required reviewers enforce quality before merge.

Code scanning

Statically analyzes code (e.g., CodeQL) to find vulnerabilities and bugs (GHAS).

Code Security

The core of GitHub's Code Scanning feature, which statically analyzes (SAST) source code to detect vulnerabilities; the default engine CodeQL builds a code database and uses dataflow analysis (source→sink) to find dangerous paths (third-party SAST tools can also be integrated). Note that "GitHub Code Security" is a subscription product plan introduced in 2025 (bundling Code Scanning, Copilot Autofix, etc.), not a rename of the Code Scanning feature itself.

Code signing

Applying a digital signature to software or an installer so that users can verify the publisher's authenticity and that the file has not been tampered with after distribution. The signer signs the hash with their private key, and users verify it with the signer's public key (certificate).

CodeDeploy (deployment groups/agent)

A deployment group bundles targets (EC2 tags, ASG, ECS/Lambda) and method (in-place/blue-green, canary/linear). appspec.yml defines lifecycle hooks to validate and auto-roll back on failure; EC2 needs the CodeDeploy agent.

CodeDeploy deployment configurations

Clarifying CodeDeploy concepts. Deployment type = in-place or blue/green (EC2/on-prem). Deployment configuration = rules for traffic shift or healthy-host count: Lambda/ECS use Canary/Linear/AllAtOnce, while EC2 uses minimum healthy hosts (OneAtATime/HalfAtATime, etc.). Hooks and alarms enable automatic rollback.

CODEOWNERS

A file that auto-requests reviewers when a PR changes specific paths.

CodePipeline (stages/actions/approval)

A CI/CD orchestrator. A pipeline is composed of stages (source → build → test → deploy), each with actions; a manual-approval action gates before production. Artifacts are passed via S3.

CodeQL query suites

A set deciding "which rules run": default (lower false positives), security-extended (broader, more noise), and org custom queries. Balances detection breadth vs false positives.

Cohesion

A measure of how strongly the elements inside a single module are focused on one purpose; higher cohesion means better design. From weakest to strongest it runs coincidental < logical < temporal < procedural < communicational < sequential < functional, with functional cohesion (doing exactly one job) being ideal. When partitioning modules, a system architect organizes responsibilities so each module is highly cohesive, improving maintainability and reusability.

Colab Enterprise

The familiar Colab notebook experience integrated with Google Cloud's IAM, VPC, and data governance for enterprise use. Unlike personal Colab, compute runs inside the customer's own Google Cloud project, making team collaboration and access control easier. Well suited to ease-of-use-focused collaborative work.

Cold standby / cross-Region DR

AWS’s standard DR has four tiers—backup & restore, pilot light, warm standby, and multi-site (active-active)—chosen by RTO/RPO vs cost. Cold standby is an informal term close to backup & restore (minimal standby). Cross-Region DR recovers in another Region via inter-Region copies of AMIs/snapshots/data plus IaC.

Collaboration apps (Loop/Whiteboard/Forms/Planner)

Microsoft 365 collaboration apps that interconnect: Loop (shared components), Whiteboard, Forms (surveys), Planner/To Do (tasks), Bookings (scheduling), and Stream (video).

Collect / ClearCollect (collections)

Add to or reset an in-app temporary table (collection); used to hold temporary data or work offline.

Collision Domain

A collision domain is the network segment within which simultaneous transmissions by multiple devices can collide, with an entire hub- or repeater-connected segment forming one collision domain. An L2 switch isolates each port into its own collision domain, and full-duplex links effectively eliminate collisions altogether. A frequently tested contrast is that collision domains are segmented per switch port, unlike broadcast domains.

Color universal design (CUD)

A design approach that takes into account the diversity of color perception (differences in color vision) so that as many people as possible can read information correctly. The key point is not to distinguish information by color alone, but to combine shape, position, text, or patterns so it can still be told apart.

Column (Dataverse)

A field on a table with a type (text, number, date, choice, lookup) and rules like required; formerly called a field.

Column-level security (Fabric)

Data-level security that hides specific columns from users. In the warehouse or SQL analytics endpoint, GRANT/DENY restricts access per column—a different axis from row-level security (RLS, rows vs. columns)—and the two can be combined.

Column-oriented database

A storage approach that organizes data by column rather than by row. Because values from the same column are stored together, it excels at compression and read performance for analytical queries that aggregate only specific columns.

Columnar formats (Parquet/ORC)

Analytics-oriented formats storing data by column. Reading only needed columns cuts scan and I/O and compresses well, greatly lowering Athena/Spark cost.

Combinational circuit / sequential circuit

A combinational circuit is one whose output depends only on the current inputs (built from gates such as AND/OR/NOT). A sequential circuit contains memory elements such as flip-flops, so its output depends on both current inputs and past internal state. This distinction underlies embedded timing design and state-transition design; sequential circuits require clock-synchronized behavior analysis.

Combo box

A searchable control that also supports multi-select; used instead of a dropdown for long lists or multiple choices.

Command history (history)

A record of previously run commands: history lists them, !number re-runs one, !! repeats the last. Saved to ~/.bash_history on logout.

Command injection

An attack technique that gets an unintended OS command executed on the server through a web application's input field. It arises from implementations that pass input straight into part of a shell command, and is prevented by validating input and replacing shell invocations with APIs that avoid the shell entirely. Like the related SQL injection and cross-site scripting (XSS), insufficient input sanitization is the root cause.

Command job

The basic job that runs a single script with a specified environment, compute, and inputs. Pass parameters and data inputs, and diagnose failures via logs.

Command substitution

A notation embedding a command output inline: $(command) or `command` (backquotes), e.g., FILES=$(ls *.log) captures the result into a variable.

Commissioning business and small/medium subcontracted business

The names for the parties to a transaction under the Act on Ensuring the Proper Handling of Subcontracting Transactions (formerly the Subcontract Act): the ordering party is the commissioning business, and the receiving small/medium enterprise is the small/medium subcontracted business — terms that replaced the former 'parent enterprise' and 'subcontracted enterprise' following the January 2026 revision. Commissioning businesses are obligated to avoid abusing their superior position, such as by delaying payment.

Commit

A snapshot of changes at a point in time, identified by a unique hash (SHA) computed from its content.

Committed (CUD) and sustained (SUD) use discounts

CUD = a discount for committing to 1-3 years of usage (for steady use); SUD = an automatic discount the longer you run, with no contract.

Common Criteria (ISO/IEC 15408)

An international standard for evaluating the security functions of IT products, expressing the rigor of evaluation with an Evaluation Assurance Level (EAL). In Japan, JISEC operates as a third-party certification scheme based on this standard, objectively evaluating and certifying security functions including tamper resistance of products such as IC cards.

Common frame (SLCP-JCF)

A framework (SLCP-JCF, the common frame) that standardizes the work content and terminology across the whole software lifecycle from planning through development, operation, maintenance, and retirement, so that acquirers and suppliers can transact with a shared understanding. It organizes work into processes, activities, and tasks and clarifies contract scope and responsibility sharing, but does not prescribe concrete procedures or methodologies themselves. The architect frames the transaction and division of requirements definition and design in common-frame terms to prevent misunderstandings.

Communication Compliance

Microsoft Purview Communication Compliance detects inappropriate language or policy violations in email and chat and flags them as policy violations.

Compaction (small-file consolidation)

Consolidates many small files into fewer large ones, reducing metadata load and scan overhead to improve read performance.

Companies Act and Financial Instruments and Exchange Act

The Companies Act sets out the basic rules for companies, including the establishment, organization, operation, and governing bodies (general meeting of shareholders, board of directors, and the like) of joint-stock companies, and the preparation and disclosure of financial statements. The Financial Instruments and Exchange Act (FIEA) regulates the issuance and trading of securities and financial-instruments business, mandating information disclosure such as securities reports and the internal-control reporting system (J-SOX) to protect investors and ensure fair markets. Both laws are closely tied to the governance and disclosure practices of listed companies and underpin corporate compliance and internal-control design.

Competitive quotation

A procurement method in which the same requirements are presented to multiple suppliers, and quotations are obtained from each to compare price, delivery time, and quality. It is used to prevent collusion with a specific vendor or unfairly high pricing, improving the transparency and fairness of procurement.

Competitive strategy

A collective term for strategies to gain advantage over competitors. Using methods such as SWOT and five-forces analysis, PPM, and core-competence management to analyze markets and rivals, it aims to establish a sustainable competitive advantage through cost leadership or differentiation.

Compliance

A management practice by which an organization adheres to laws, internal rules, and industry codes of conduct. Beyond information security, it spans labor law, accounting standards, and other norms; violations directly threaten corporate trust and viability and are therefore treated as a management risk.

Compliance Manager and compliance score

Microsoft Purview Compliance Manager visualizes conformance to regulations/standards via improvement actions and a compliance score, helping prioritize risk reduction.

Compliance programs and AWS Artifact

AWS complies with third-party certifications (ISO, SOC, PCI DSS, HIPAA, FedRAMP) and provides their audit reports on demand via AWS Artifact. Scope is shared per the shared responsibility model.

Compliance reporting

Assessing and reporting adherence to standards and regulations; continuously surfaced by AWS Config (rule compliance), Audit Manager (evidence collection), and Security Hub (aggregated scores).

Compliance Score

A metric from Microsoft Purview Compliance Manager indicating how well you meet regulations/standards; it rises as you complete recommended improvement actions.

Compliant device

A device evaluated as compliant by Intune, used as a Conditional Access grant control ("require a compliant device").

Component (Power Pages)

Building blocks placed on pages—text, image, form, list (a view of Dataverse data), iFrame—arranged by drag-and-drop.

Component (reusable step)

A reusable unit of processing bundling inputs, outputs, code, and environment. Composed as pipeline steps and versioned/shared.

Component diagram

A UML structural diagram that represents the physical software parts (components) making up a system, together with the interfaces they provide and require and their dependencies. It shows coupling between parts via provided interfaces (ball) and required interfaces (socket), helping examine the split into units of reuse or deployment. Its subject differs from a deployment diagram, which shows runtime node placement.

Composite action

An action bundling multiple steps (run: and other actions’ uses:); invoked as a single step via uses: in a workflow.

Composite model

A model mixing Import and DirectQuery (or Direct Lake); choose a mode per table, with dual mode allowing both.

Compute cluster

Autoscaling compute that scales training or batch inference. It can shrink to 0 nodes when idle and use low-priority/Spot VMs to cut cost.

Compute Engine

Google Cloud IaaS providing virtual machines (VMs) with selectable CPU/memory and OS-level control; ideal as a lift-and-shift target.

Compute instance

A managed VM for individual development and notebook execution. It can be stopped to save cost and includes a terminal and Jupyter.

Computer graphics (CG)

The general set of techniques for generating and processing images and video with a computer. It ranges from 2D illustration and rendering to 3D modeling and animation, and is applied widely in film, games, and product-design simulation.

Computer vision

The AI field analyzing images/video to recognize objects, text, and faces (classification, detection, OCR, face).

Concatenate (string join)

Joins multiple strings into one (the & operator also works); used to build full names or display text.

concurrency

Limits same-group runs to one at a time; with cancel-in-progress: true a new run auto-cancels in-progress older runs, validating only the latest and saving cost.

Conditional Access

Grants or challenges access based on conditions like location, device, or risk (a Zero Trust implementation).

Conditional formatting (Power BI)

Formatting that varies background/font color, data bars, or icons by value to highlight—distinct from a theme (blanket palette).

Conductors and insulators (semiconductors)

A conductor is a material that carries electricity well (metals such as copper and iron) and is used for wiring. An insulator barely carries electricity (rubber, glass, etc.) and is used, for example, as protective sheathing to prevent electric shock. A semiconductor has properties in between, and how easily it carries electricity changes depending on conditions; it is the material for electronic parts such as ICs.

Confidence interval

A range constructed so that, if the same estimation procedure were repeated many times, a specified proportion of the resulting intervals (e.g., 95%) would contain the true value (e.g., a 95% confidence interval). It does not mean a single interval has a 95% probability of containing the true value—that describes the long-run procedure, not one instance. Reporting this range alongside a point estimate lets you interpret the result properly given sample size and variability.

Confidential Computing

Processes data in use (in memory) within encrypted VMs/nodes, protecting it from the host/other tenants; a different surface (data in use) than encryption at rest/in transit.

Confidential disk encryption and double encryption

In addition to confidential disk encryption that protects confidential-VM disks with virtualization-based security, you can configure double encryption layering platform and customer keys.

Confidential VM

A VM that hardware-encrypts in-use memory (data in process) for the highest isolation, protecting sensitive workloads on Azure Virtual Desktop session hosts. It is a different protection layer from Trusted Launch (secure boot + vTPM), which strengthens boot integrity.

Config aggregator and org compliance

Aggregates AWS Config data across multiple accounts/Regions into one place to centrally evaluate and visualize org-wide resource configuration and compliance.

Config configuration recorder

The core AWS Config capability that continuously detects configuration changes on tracked resources and records them as time-series Configuration Items. Without enabling the recorder, neither Config rule evaluation nor the resource timeline works, and it must be enabled per Region.

Config Connector

An Infrastructure as Code tool that manages Google Cloud resources declaratively the Kubernetes way.

Configuration item (CI)

A configuration item (CI) is a component that is individually identified and managed as a subject of configuration management, and it can take many granularities such as hardware, software, documents, or services. Each CI carries attributes such as type, version, and status, and forms the service structure through its relationships with other CIs. The IT service manager designs how far to manage things as CIs (the level of granularity), judging the balance between a level too fine to maintain and one too coarse to be useful for impact analysis.

Configuration management

The activity of identifying and recording versions of deliverables, documents, and baselines, and applying only approved changes to keep them consistent. Working alongside integrated change control, it ensures the authoritative baseline version can always be uniquely traced.

Configuration management (service management)

The activity of identifying, recording, and managing the configuration items (CIs) that make up a service and understanding the relationships among them. Maintaining accurate configuration information provides the basis for impact analysis of changes and releases, tracing the cause of incidents, and designing for availability. Its purpose differs from IT asset management, which focuses on financial value; configuration management centers on the accuracy of the relationships and states needed to deliver the service. The IT service manager designs controls to keep configuration information accurate and current so that other management activities can rely on it for decisions.

Configuration management tool

A tool that codifies server settings and software configuration and applies/manages them consistently across many machines (e.g., Ansible). It supports machine reprovisioning and scale-out in stateless architectures.

Configuration management tool (Ansible)

A tool that automates and standardizes configuration changes and software installs across many servers. Target hosts are tracked in an inventory, and YAML-based playbooks run tasks through modules. It is agentless (works over SSH) and idempotent, so re-running the same playbook yields the same result — letting the same workflow provision VMs and containers, roll out application releases, and reconfigure network devices.

Configuration profiles

Apply common settings (language, time zone, display) to many Teams devices at once. Distinct from device tags (grouping by location/purpose).

Configuration variables

Non-secret settings defined at repo/environment/org level and read via the vars context; use secrets for sensitive values (variable values can appear in logs).

Configuring alerts (Fabric)

Settings that detect refresh failures or met conditions and notify; combined with Data Activator/monitoring to automate operations.

Conflict management

The activity of resolving team conflicts by selecting from five techniques as appropriate: withdraw/avoid, smooth/accommodate, compromise, force/direct, and collaborate/problem-solve. Collaborate/problem-solve, which aims for a solution satisfying both parties, is generally considered the most desirable technique, and choosing the right one for the situation (urgency, relationship) is important.

Conformance pack

A mechanism that bundles multiple Config rules and remediation actions into one template for bulk deployment across an account or an entire organization. It is used to apply common baselines like PCI DSS or CIS benchmarks at once, avoiding configuring each rule individually.

Congestion Control

Congestion control detects traffic exceeding network or router capacity and adjusts sending rates to prevent collapse. TCP implements it end-to-end via slow start, congestion avoidance, and fast retransmit/fast recovery, while routers implement network-side active queue management such as RED (Random Early Detection), which probabilistically drops packets before the queue fills to preemptively trigger TCP congestion avoidance.

Connected organizations

In entitlement management, registers trusted external partner orgs so their people can request access packages; creates external guests on approval and expires them via external-user lifecycle.

Connection draining

When removing an LB backend, stops new connections while letting existing ones finish before detaching, enabling zero-impact maintenance; note it is not an instant cutoff.

Connection Monitor

A Network Watcher feature that continuously monitors reachability, latency, and packet loss between endpoints, detecting route changes and failures.

Connection pool

Reuses database connections to avoid connection setup cost and exhaustion; especially important for serverless/high-concurrency apps.

Connection pooling

A mechanism that pre-establishes database connections and holds them in a pool, avoiding the overhead of opening a new connection per request and preventing connection exhaustion. Amazon RDS Proxy is the flagship example, and it matters most for serverless/high-concurrency apps like Lambda.

Connection reference

An abstraction that makes a flow’s connector connection portable in a solution; rebind to the actual connection per environment.

Connection tracking

How a stateful firewall (e.g., a security group) remembers established connections in a state table and automatically allows their return traffic. Unlike stateless rules, it removes the need to separately open the ephemeral-port range for the return leg.

Connectivity mode (gateway / direct)

Two Cosmos DB SDK connectivity modes. Gateway uses HTTPS (443), firewall-friendly but slightly higher latency. Direct connects over TCP straight to replicas—low latency, high throughput, recommended for production. Reuse CosmosClient as a singleton.

Connectors (Power Platform)

Components linking to 1000+ external services (Microsoft 365, SQL, SaaS); standard and premium connectors (premium may need extra licensing).

Connectors (RJ-45 / RJ-11)

Connector standards for plugging cables into equipment. RJ-45 is an 8-pin connector for twisted-pair cable and the Ethernet standard; RJ-11 is a smaller 4-to-6-pin connector for analog telephone lines, similar in appearance to RJ-45 but smaller.

Consistency

One of the ACID properties, guaranteeing that a database always satisfies its defined constraints, such as uniqueness or referential integrity, both before and after a transaction. It prevents transitions to contradictory data states and maintains the correctness of business data.

Consistency levels (Cosmos DB)

Five levels trading read consistency against performance/availability: strong → bounded staleness → session (default) → consistent prefix → eventual.

Consistency levels (Cosmos DB)

Five levels defining how fresh reads are. Strongest first: strong (always latest, no MRW), bounded staleness (lag up to K ops/T time), session (read-your-writes, default), consistent prefix (order guaranteed), eventual (weakest/fastest/cheapest). Override per query only toward weaker.

Console / terminal emulator

The text screen for operating the shell; you enter commands via a physical text console or a terminal emulator that provides it on the desktop.

Console port

A dedicated port on a router or switch for connecting a console cable directly and accessing the CLI through a terminal emulator. It is an out-of-band management method used for initial setup or when network access is unavailable.

Consumption-based pricing

Paying for what you actually use rather than reserved capacity; no up-front investment and less waste.

Contact Center as a Service (CCaaS)

A general term for cloud-delivered contact center platforms (SaaS-based, multichannel, no on-prem hardware; e.g., Amazon Connect, Genesys Cloud, Five9). In the Google Cloud context this refers to Google's CCaaS offering within the Customer Engagement Suite, combined with Conversational Agents and Agent Assist to automate and assist customer service.

Contained database user

A user whose authentication (password or Microsoft Entra ID) is bound to the database itself rather than depending on a server-level login. The standard pattern in Azure SQL Database, it avoids having to recreate server logins when a secondary is promoted in a failover group.

Container

A canvas-app element that groups controls and auto-arranges them by screen size; used to build responsive layouts.

Container (Linux)

A lightweight runtime that shares the host OS kernel and isolates processes with namespaces; it starts no guest OS so it is fast and light, but can only run the host OS family.

Container filesystem

The filesystem visible inside a container, built by stacking the layers of its source image. An image itself is a set of read-only layers; when a container runs, one writable layer is added on top.

Container image

An immutable package of an app and its dependencies; built from a Dockerfile, pushed to a registry (ACR), and run by services.

Container Insights / Lambda Insights

CloudWatch extensions that automatically collect detailed operational metrics and logs (CPU, memory, disk, network) for ECS/EKS containers and Lambda functions. They feed dashboards and anomaly-detection alarms, surfacing bottlenecks specific to container and serverless platforms.

Container virtualization

A lightweight virtualization approach in which multiple application runtime environments (containers) share the host OS kernel, with processes and file systems isolated via namespaces. Compared with hypervisor-based virtualization (which runs a full guest OS), it starts faster and has less overhead, but it depends on the host kernel, so it cannot run a kernel of a different OS type. Docker is a representative implementation.

Containerization

Packaging an app and its dependencies into one image that runs the same anywhere. Lighter and faster to start than VMs, with higher density and portability. On AWS, run via ECR (registry) + ECS/EKS (orchestration) + Fargate (serverless).

Containerized/serverless compute for AI

Execution platforms for inference and AI pipelines. Azure Container Apps (scalable, KEDA) and Azure Functions (event-driven) run model calls and pre/post-processing serverlessly.

Content exclusion

A setting that keeps specific files/repositories out of Copilot’s context and suggestions to protect sensitive or policy-restricted code; admins set it at repo/org level, and excluded targets get no suggestions.

Content explorer

A Microsoft Purview tool that visualizes the actual content and storage location (SharePoint, Exchange, OneDrive, etc.) of items with applied sensitivity labels or sensitive information types (SITs). It is a snapshot of what exists where, distinct from Activity explorer, which tracks who did what over time. Viewing content requires an additional permission.

Content filters and blocklists

Safety features of Azure OpenAI / Content Safety: filter by per-category severity thresholds and add banned terms via a custom blocklist.

Context gathering and prompt building

Input processing that selects relevant info from around the cursor, open files, and related files to build the prompt; excluded files are left out.

Context window optimization

Designing to make efficient use of a model's context window (a finite token budget). In RAG, retrieve and pass only the most relevant chunks; for conversation history, compress via summarization or trim old turns—keeping irrelevant information out to balance answer quality against latency and cost.

Context window overflow

A condition where input+output tokens exceed the model context-window limit. Behavior varies by model/API (input truncation, error responses, or dropping old conversation history) and can cause cut-off answers or missing information; addressed with dynamic chunking, prompt design, and response-size limits.

Context-aware access

A zero-trust control that allows/restricts access by conditions like device posture, location/country, IP range, and whether a corporate device; a layer combined with auth strengthening (2SV/SSO).

Contexts

Objects to access runtime metadata—github, env, vars, secrets, inputs, matrix, needs, runner, job, steps, etc.

Contingency plan

A response plan that is executed when a predefined trigger condition indicating a risk has occurred is met. Rather than responding ad hoc after a risk materializes, having this planned in advance enables a fast and consistent response.

Contingency reserve

A reserve included within the cost baseline to address identified risks (known unknowns). Its amount is estimated from risk analysis (e.g., expected monetary value), and it can be used at the project manager discretion. It is distinct from the management reserve, which is controlled by senior management for unidentified risks (unknown unknowns).

Continual service improvement (CSI)

The ongoing effort to review and improve services and processes based on measured KPIs and metrics. It repeats the PDCA cycle of measuring the current state, analyzing gaps against targets, implementing improvements, and confirming their effect. Rather than ad hoc changes, a service manager prioritizes improvement targets on the basis of data and accumulates small improvements to raise service value continually. Note that "CSI (continual service improvement)" is ITIL v3 terminology for a dedicated lifecycle stage; in ITIL 4 it has evolved into continual improvement as a guiding principle and practice rather than a separate stage.

Continuation token

A token that paginates a large query result and carries the resume position to fetch the next page efficiently. Distinct from the ETag used for concurrency control.

Continuous access evaluation (CAE)

Revokes sessions immediately on dangerous changes (account disabled, location change, risk rise) without waiting for token expiry. Unlike token-lifetime reliance, it cuts off access quickly after compromise.

Continuous monitoring for generative AI (drift/bias)

Operations that continuously monitor production generation quality, auto-detecting data drift, bias drift, guardrail violations, and cost/latency anomalies to drive remediation—combining CloudWatch metrics, Bedrock logs, model evaluations, and human review.

Control chart (quality)

A chart that plots process measurements over time against upper and lower control limits to determine whether a process is in statistical control. Nonrandom patterns, such as seven consecutive points on one side of the mean, are flagged as out of control, making this important for statistically judging whether corrective action is needed.

Control flow (if / case / for / while)

Branching and looping in scripts: if…fi is a conditional ([ ] is test), case…esac branches a value by patterns, and for/while…done loop. The key is not to confuse the closers (fi/esac/done).

Control Plane and Data Plane

The control plane handles route computation and policy decisions that determine forwarding rules, while the data plane executes the actual packet forwarding according to those rules. SDN separates the two and centralizes the control plane, allowing flexible, network-wide programmatic control.

Control risk

The risk that a material error or fraud will not be prevented or detected even though internal controls exist. The auditor assesses the design and operating effectiveness of controls to gauge this risk, and applies more extensive substantive testing where control risk is judged high. Like inherent risk, it is a condition the auditor assesses rather than directly manages.

Control types (preventive, detective, corrective)

A functional classification of internal controls into three types. Preventive controls stop errors or fraud before they occur (authorization limits, segregation of duties, access controls); detective controls identify errors or fraud that have occurred (document matching, log monitoring, exception reporting); corrective controls remediate identified problems and prevent recurrence. Auditors assess the combination and coverage of these control types.

Control types (preventive/detective/responsive)

Categories of security controls: preventive (stop it happening—SCPs, IAM, SGs), detective (find what happened—Config, GuardDuty, CloudTrail), and responsive/corrective (auto-fix—SSM Automation, Config remediation). Layered together; Control Tower guardrails follow this model.

Controls (Power Apps)

UI components placed on app screens—labels, text inputs, buttons, dropdowns, galleries, forms—configured via properties for look and behavior.

Convergence

Convergence is the process—or the time required—for all routers in a network to reach a consistent view of routing information after a topology change such as a link failure or new route. Slow convergence can cause temporary routing loops or black holes, making convergence time a key metric for evaluating routing protocol design.

Conversation history / session memory

Storing and referencing prior turns so multi-turn conversations keep context—persisted in DynamoDB, etc., and passed back to the prompt as a summary/relevant subset to avoid context overflow. Bedrock Agents handle memory per session.

Conversational Agents

A solution to build conversational agents/chatbots that converse in natural language, automating tasks like customer support.

Conversational Language Understanding (CLU)

A custom language model extracting intents and entities from user utterances. Add utterances to train, evaluate, deploy, and consume from clients (successor to LUIS).

Convolutional layer and pooling layer

Representative layers that make up a convolutional neural network (CNN). A convolutional layer slides a filter (kernel) over the image to detect local features (such as edges), producing a feature map. A pooling layer downsamples the feature map by aggregating each local region (e.g., max pooling takes the maximum value), reducing its size while adding robustness to positional shifts and cutting computational cost.

Cooldown and warmup

Cooldown suppresses the next scaling evaluation for a set period right after Auto Scaling takes a scaling action, preventing excessive back-to-back scaling (flapping) while metrics catch up. Warmup is the grace period before a newly launched instance is counted into target tracking scaling's average-value calculation.

Copilot administration (usage and prompts)

Monitor usage and adoption via Copilot Analytics and Microsoft 365 admin center reports to drive enablement and license optimization. Prompt management saves, shares, schedules, and deletes frequently used prompts to reuse/standardize them across the org.

Copilot Analytics

A reporting capability that visualizes Copilot usage and adoption. Used alongside the Microsoft 365 admin center to drive enablement and optimize licenses.

Copilot Chat

A conversational surface to ask questions and request code generation, explanation, fixes, and tests in natural language; you can pass a selection or file as context.

Copilot Code Review policy

A policy to roll out Copilot code-review assistance to org standards; it does not replace human review.

Copilot control

A canvas-app control embedding a chat-style AI assistant so users can ask about and act on app data in natural language.

Copilot licensing and billing

Copilot offers a fixed monthly license and pay-as-you-go (PAYG, applied to uses like SharePoint agents) billed by usage; PAYG cost is managed via billing policies. Licenses are assigned to users/groups in the Microsoft 365 admin center.

Copilot org policy (feature availability)

An enterprise/org-level setting managing who can use which Copilot features and how; spans the IDE and github.com and is above individual settings.

Copilot pay-as-you-go (PAYG)

A Copilot model billed by usage, separate from the fixed monthly license. Applied to uses like SharePoint agents, with cost managed via billing policies.

Copilot-supported editors/IDEs

GitHub Copilot installs as an extension in Visual Studio Code, Visual Studio, JetBrains IDEs, Neovim, and more; completion and Chat run inside the editor.

CoPP (Control Plane Policing)

A security feature that applies policing (rate limiting) to traffic destined for a router's or switch's control plane (its CPU), preventing excessive traffic from starving it. It classifies packets addressed to the device itself (routing protocol traffic, management access, ICMP, and so on) and sets an allowed rate per class, protecting the CPU from a DoS attack or a misconfiguration-driven overload.

Copy activity

A pipeline activity that moves large data fast; incremental loads use a watermark column to pull only new rows.

COPY statement and \copy

Mechanisms for bulk data transfer between a table and a file. The SQL COPY statement reads/writes a file on the server directly under the server process's privileges. The psql meta-command \copy handles the file under the client's privileges, internally issuing COPY.

Copyleft and permissive

Two families of OSS licenses: copyleft requires derivatives you redistribute to carry the same license (source disclosed), a propagating condition; permissive lets you close modifications if you keep the copyright notice. The trigger for obligations is generally "redistribution".

Copyleft licenses (GPL/AGPL/LGPL)

Copyleft licenses: GPL is the flagship, extending disclosure to the linked whole; AGPL extends it to network provision (SaaS); LGPL is the library relaxation where mere linking does not propagate.

Copyright

A right that arises automatically the moment a work such as a novel, music, or a program is created; unlike a patent right, no registration procedure is required. Copyright in a program generally belongs to the person who created it, except in the case of a work made for hire.

Core competence

A company's core, hard-to-imitate strength, such as proprietary technology or know-how. Unlike a strength tied to one product or business, it can be deployed and applied across multiple business domains; firms define their business domain around it to sustain competitive advantage.

Corporate governance

The system that disciplines and oversees management so that a company is run in line with the interests of shareholders and other stakeholders. Through board and auditor oversight, outside directors, information disclosure, and internal control, it secures the transparency, soundness, and accountability of management. An IT strategist aligns IT governance with corporate governance so that IT strategy and IT investment fit the oversight and accountability framework.

Correlated subquery

A query in which the inner subquery references values from each row of the outer query, so the subquery is re-evaluated for every outer row. It is used when the comparison basis differs per row, such as "employees earning more than their own department's average salary."

Correlation

A statistical measure (correlation coefficient) of how strongly two variables move together. A strong value doesn't imply one causes the other (correlation ≠ causation), so it must be interpreted carefully during exploratory data analysis.

correlation (statistic)

A statistic ranging from -1 to 1 that expresses how closely a column's logical value order matches its physical storage order. Values near 1 mean the physical order matches the sort order well, favoring Index Scan since disk reads stay sequential — one input the planner uses when choosing a scan method.

Correlation and causation (IT Passport basics)

Correlation is when some relationship is observed between two phenomena. Causation is a relationship where one is the cause and the other the resulting effect. It is important to note that correlation does not necessarily imply causation (a spurious correlation).

Cosmos DB APIs

Cosmos DB offers multiple APIs by workload: NoSQL (document, default), MongoDB, Cassandra, Gremlin (graph), and Table—chosen for migration or use case.

Cosmos DB operations with the SDK

Development operations to create/read/query/update databases/containers/items via CosmosClient; request cost is measured in RUs.

COSO framework

A framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO cube). It consists of five components: control environment, risk assessment, control activities, information and communication, and monitoring, supporting the objectives of operational effectiveness/efficiency, reliable financial reporting, and compliance. Auditors assess the design of internal control against these five components.

Cost allocation (chargeback/showback)

Allocating cloud spend to teams/projects. Chargeback bills each unit for actual cost (accountability); showback only shows usage without billing (awareness). Implemented via cost allocation tags, Cost Categories, and Cost Explorer.

Cost and Usage Report (CUR)

The most granular billing data report AWS provides. It outputs hourly usage, pricing, and discount breakdowns in CSV/Parquet to S3, serving as the source data for advanced analysis and chargeback via Athena or QuickSight.

Cost Anomaly Detection

Uses machine learning to learn normal usage patterns and automatically detects/alerts on unexpected cost spikes—catching anomalies earlier than after-the-fact budget alerts.

Cost baseline

The time-phased, approved project budget (cumulative cost by phase or period), which excludes the management reserve but includes the contingency reserve. Earned value PV is derived from this baseline and serves as the reference point against which actual performance is compared.

Cost Categories and cost allocation tags

Mechanisms for apportioning spend across organizational units such as projects or departments. Cost allocation tags aggregate cost by resource tag, while Cost Categories combine rules (account, tag, service, etc.) to group costs into arbitrary hierarchies; both serve as filter dimensions in Cost Explorer and reports.

Cost governance

Organizationally governing cloud spend: alert via Budgets and anomaly detection; visualize with cost allocation tags and categories; curb over-provisioning via SCPs/Service Quotas; optimize with purchase options (RI/SP/Spot). The operational basis of FinOps.

Cost of quality

The umbrella term for conformance costs (prevention and appraisal costs) and nonconformance costs (internal and external failure costs). Investing more in prevention and appraisal tends to reduce failure costs, making this an important framework for deciding where quality investment should be directed.

Cost Optimization Hub

A Billing feature that consolidates cost-saving opportunities across the org (unused resources, right-sizing, Savings Plans/RI recommendations) ranked by estimated savings—aggregating recommendations from Compute Optimizer and Trusted Advisor.

Cost performance index (CPI)

An EVM metric that evaluates cost performance. CPI = EV (earned value) ÷ AC (actual cost); 1.0 means on budget, below 1 indicates a cost overrun (inefficiency), and above 1 indicates better-than-budgeted efficiency.

Cost variance (CV)

A metric computed as CV = EV minus AC that indicates whether the project is under or over budget. A positive value means the project is within budget and a negative value means it is over budget; combining it with SV (for example, low SPI and low CPI together mean both delayed and over budget) is how corrective action is diagnosed.

Cost-reimbursable contract (cost-plus)

A contract type that reimburses actual incurred costs plus an agreed fee (either fixed or a percentage of cost). Because the risk of cost overrun falls mainly on the buyer, it suits exploratory work with undefined requirements, but it places a heavier cost-monitoring and control burden on the buyer.

Coupling

A measure of how strongly modules depend on one another; lower coupling means better design. From strongest (worst) to weakest it runs content > common > external > control > stamp > data, with data coupling (passing only the needed data as arguments) being the most desirable. Good design combines high cohesion with low coupling, and a system architect minimizes interfaces so that the ripple effect of changes stays localized.

Coupling and cohesion (module design metrics)

Two metrics for evaluating module decomposition quality. Coupling measures inter-module dependency strength (content coupling worst to data coupling best); cohesion measures how tightly elements within a module relate (coincidental cohesion worst to functional cohesion best). Low coupling with high cohesion yields the most maintainable design.

Coverage criteria and multiple condition coverage

Criteria for how thoroughly white-box tests exercise the control structure. Statement coverage (execute every statement at least once) ⊂ branch/decision coverage (exercise each branch true and false) grows stricter, but condition coverage (each condition true and false) does not necessarily subsume branch coverage. Multiple-condition coverage, the strictest, exercises every combination of the truth values of all conditions in a decision and subsumes both branch and condition coverage. It quantifies test adequacy.

CPU and clock frequency

The CPU (central processing unit) is the core of a computer, handling computation and control. Clock frequency (measured in Hz) indicates how many signal cycles the CPU can process per second; generally, a higher value indicates faster processing.

CPU credits (burstable performance)

T-family instances burst above baseline by spending CPU credits, which accrue when idle; running out throttles performance. Unlimited mode allows sustained bursting for extra cost. For steady high load, C/M families fit better.

CQRS

An architecture pattern (Command Query Responsibility Segregation) that separates the write (command) model from the read (query) model. It lets each side be optimized and scaled independently when reads and writes have very different load profiles.

Crashing

A schedule compression technique that shortens activity durations on the critical path by adding resources such as staff or budget. Because it always increases cost, the optimal approach is to apply it first to the activity with the lowest additional cost per unit of time saved.

CREATE INDEX CONCURRENTLY

An option that builds an index without blocking writes. It is slower than a plain CREATE INDEX, cannot run inside a transaction block, and if it fails partway through it can leave behind an incomplete INVALID index, requiring a status check and, if needed, DROP INDEX followed by a retry.

CREATE STATISTICS / pg_statistic_ext

Extended statistics that capture correlation across multiple columns (columns that are logically strongly linked). CREATE STATISTICS defines the statistics object (registered in the pg_statistic_ext catalog), and after ANALYZE runs the actual statistics data is stored in pg_statistic_ext_data. It improves selectivity estimates for combined WHERE clauses that single-column statistics alone tend to over- or under-estimate. There are three kinds: ndistinct captures the number of distinct combinations of column values, dependencies (functional dependencies) captures functional dependencies between columns, and mcv (most-common-values) captures a list of frequent value combinations.

createdb / dropdb

Command-line wrappers that create and remove databases, internally issuing CREATE DATABASE and DROP DATABASE statements. createdb accepts a -T option to specify the source template.

createuser / dropuser

Command-line wrappers that create and remove roles (users); internally they issue CREATE ROLE and DROP ROLE statements respectively.

Credential report

A CSV report listing, for every IAM user in the account, whether a password exists, MFA status, and each access key's creation and last-used date. It can be generated at most once every 4 hours and is the starting point for auditing and deactivating unused credentials.

Credential stuffing

An attack that reuses real ID/password pairs leaked from other services against a different service to break into accounts of users who reuse credentials. It is characterized by low-rate attempts from many IPs; multi-factor authentication and avoiding password reuse are effective countermeasures.

Critical path

Among all the paths from a project's start to its finish, the one with the longest duration. If any task on this path slips by even one day, the overall project completion date slips as well.

Critical section

A section of code that accesses a shared resource such that concurrent execution by multiple tasks or interrupt handlers could cause inconsistency (a race condition). Access from elsewhere must be prevented during this section, typically by disabling interrupts or using a mutex, but making the section longer than necessary degrades interrupt responsiveness and task-switch latency, so it should be kept as short as possible.

CRM (Customer Relationship Management)

A management approach and system for building and maintaining customer relationships to raise customer satisfaction and repeat-purchase rates, by centrally managing and utilizing purchase and inquiry history.

cron / crontab (periodic scheduling)

Runs tasks periodically at set times: edit with crontab -e using the format "minute hour day month weekday command". User jobs live in /var/spool/cron/, system ones in /etc/crontab (with a user column), /etc/cron.d/, and cron.{hourly,daily,weekly,monthly}/. Access control via cron.allow/cron.deny (allow wins if present).

Cross compiler

A compiler that generates executable binaries for a target device with a different architecture or OS than the host environment (e.g., a PC) on which development is performed. Because an embedded target often lacks the computing resources or storage to run development tools itself, the common development flow is to cross-compile on a powerful host PC and then transfer and flash the resulting binary to the target.

Cross-account access

Access where a principal in one account assumes a role in another via AssumeRole; permitted by a trust policy, with ExternalId guarding against the confused-deputy problem for third parties.

Cross-Cloud Interconnect

A service that links another public cloud to Google Cloud over a dedicated physical link without the internet; use it for multicloud connectivity when you need more bandwidth/lower latency than Cloud VPN.

Cross-filter direction

The direction a filter propagates over a relationship. Single (dimension→fact, one-way) is the safe default; bidirectional risks ambiguity/cycles and is used only when needed.

Cross-Region Inference

An Amazon Bedrock inference-profile feature that auto-routes inference requests across Regions, absorbing single-Region capacity shortfalls and Region failures to raise availability (routing of inference, not data replication).

Cross-region Load Balancer

Bundles regional Load Balancers behind one global IP for geo-redundancy and low-latency routing.

Cross-site request forgery (CSRF)

An attack that exploits a user's active login session on a legitimate site, tricking them via a malicious site into sending an unintended request (such as a transfer or post) to the legitimate site. It is prevented by verifying one-time tokens and similar measures.

Cross-site scripting (XSS)

An attack technique that injects malicious script into a vulnerable website so it executes in a visitor's browser, potentially leading to cookie theft or a spoofed display. Escaping (sanitizing) output is the basic countermeasure.

Cross-stack references (Export/ImportValue)

Sharing values across stacks by Exporting one stack’s Outputs and referencing them via ImportValue in another (e.g., reusing a VPC ID). It can create tight coupling; nested stacks or SSM parameter references are alternatives.

Cross-tenant access settings

Per-partner-tenant control of inbound/outbound access and whether to trust the partner’s MFA/device-compliance claims. Differs in role from cross-tenant synchronization (auto-provisioning users).

Cross-tenant synchronization

Auto-provisions users from one Entra tenant into another as B2B guests, removing manual invitations. Distinct from Cross-tenant access settings, which control trust/access for partner tenants.

Cross-zone load balancing

Each node distributes evenly to targets in all AZs; when off, uneven target counts per AZ cause skew. ALB enables it by default (free); NLB disables it by default (enabling incurs inter-AZ data charges).

CRUD analysis (CRUD matrix)

A technique that verifies consistency using a matrix of functions (processes) against data (entities), recording for each function whether it performs Create, Read, Update, or Delete on each data item. It checks that every data item has functions to create and to read it and that update rights have no gaps or overlaps, surfacing missing or redundant functions and data. A system architect uses it to confirm the validity of function partitioning and access-right design.

CRUD operations

An acronym for the basic operations on data or resources: Create, Read, Update, and Delete. In a RESTful API these commonly map to the HTTP methods POST, GET, PUT (or PATCH), and DELETE respectively.

Crypto-agility (responding to cryptographic obsolescence)

Cryptographic obsolescence ("crypto degradation") is the phenomenon where a cipher or key length once considered secure becomes breakable due to increased computing power or newly discovered attack techniques. Administrators must not assume "secure at deployment means secure forever"; instead they need the capability to continuously track obsolescence and proactively migrate to stronger ciphers or key lengths — this readiness is crypto-agility. Recently, concern that quantum computers could break current public-key cryptography has made planned migration to post-quantum cryptography (PQC) an important aspect.

Cryptographic obsolescence

The phenomenon in which a cryptographic algorithm or key length once considered secure becomes breakable within a practical time frame, owing to advances in computing power or cryptanalysis. Continuing to use an obsolete scheme — such as short-key RSA or an outdated hash function — raises the risk of decryption or tampering, so readiness to migrate to stronger algorithms in a planned way (crypto-agility) is needed.

CRYPTREC ciphers list

The list of cryptographic techniques published by CRYPTREC, which evaluates and monitors the security of cryptography for Japanese e-government use. It comprises three lists: the e-government recommended ciphers list, the candidate recommended ciphers list, and the monitored ciphers list (continued use allowed for compatibility but not recommended for new systems). Ciphers found to be compromised (insufficient key length or a discovered algorithmic weakness) are removed from recommendation when the lists are revised.

CSF (Critical Success Factor)

The factor (key to success) that must be prioritized in order to achieve the KGI, a business goal. Positioned in the chain KGI (goal) → CSF (key) → KPI (intermediate metric), it clarifies where limited management resources should be concentrated.

CSIRT

An organizational team dedicated to responding to computer security incidents. It handles detection, analysis, response, and prevention of recurrence, and often coordinates with external CSIRTs and related agencies.

CSIRT operations and SOC

While the CSIRT is the command center for incident response, the SOC (Security Operation Center) is the operational team that monitors logs and alerts around the clock to detect threats and perform initial analysis. Smaller organizations often outsource this monitoring to an MSSP (managed security service provider) rather than building it in-house.

Curated Detections

Managed detection rule sets in Google SecOps, built from Google's threat research, that let you start detecting cloud and identity threats out of the box.

Currency column

A column storing monetary amounts; handles currency type and exchange rates with money-appropriate precision.

Cursor (SQL)

A mechanism, used within stored procedures or embedded SQL, for fetching and processing query-result rows one at a time. It is used for row-by-row procedural logic that set-based operations handle poorly, such as branching and updating on a per-row basis.

Custom agents

Agents built for an organization’s specific tasks and knowledge. Created in tools like Copilot Studio and published/managed through an approval process.

Custom API

A reusable custom operation (message) defined in Dataverse—bound (tied to a table) or unbound (table-independent), implemented by a plug-in. Distinct from a custom connector (which ingests an external API).

Custom connector

A connector you define for a proprietary/internal REST API not covered by built-ins, so it can be called from Power Apps and Power Automate.

Custom detection rules (Defender XDR)

A Defender XDR rule that promotes an Advanced Hunting KQL query into scheduled repeated detection + response actions (isolate/disable). The query must return appropriate entity columns to generate alerts/incidents. A different platform from Sentinel analytics rules.

Custom metrics

Application-defined metrics sent to CloudWatch via the PutMetricData API, the CloudWatch agent, or the Embedded Metric Format (EMF) extracted from logs.

Custom question answering (knowledge base)

Builds a Q&A-pair knowledge base from documents/FAQs, adding multi-turn conversation, alternate phrasing, and chit-chat before publishing; supports multiple languages.

Custom repository role

A custom repository role bundling only the needed permissions when the built-in Read–Admin levels don’t fit—useful for least privilege.

Custom roles (Azure / Entra roles)

When built-in roles lack granularity, define custom roles that allow only the needed actions. Azure resource roles and Microsoft Entra roles are managed as separate systems.

Custom secret patterns

Regex-defined patterns to detect an org’s proprietary tokens/internal keys not caught by default patterns. A too-loose regex raises false positives—tune via tests.

Custom security attributes

Org-defined key/values (e.g., Sensitivity=High) classifying users and apps (service principals); the basis of attribute-based access control (ABAC). Defining/assigning needs dedicated roles, separated from general admins.

Custom text classification

Trains a model to classify text by your own label scheme, supporting single-label and multi-label classification.

Custom tooltip (report-page tooltip)

A feature showing a separately built report page as a tooltip, revealing detail on hover over a visual.

Custom Vision

Train on your own images to build custom image classifiers/detectors.

Custom Vision training (classification/detection, mAP)

Choose image classification or object detection, label images, train via transfer learning, evaluate with precision/recall/mAP, then publish and consume.

Customer-managed keys (CMK) / Platform-managed keys (PMK)

Key-management models for encryption at rest. PMK = managed by Azure by default (no extra setup). CMK = the customer creates/rotates/revokes the key in Key Vault and assigns it as the protector for Storage or SQL TDE (e.g., compliance). The algorithm is identical; the difference is who manages the key. Disks are protected by Azure Disk Encryption (in-guest BitLocker/DM-Crypt) or encryption at host (platform), both supporting CMK.

cut

Extracts specified fields or character positions from each line: -d sets the delimiter and -f the field number (cut -d, -f2 for the 2nd CSV column).

CVE

Common Vulnerabilities and Exposures—a unique ID for an individual vulnerability in a specific product/version (e.g., CVE-2024-XXXXX). It denotes a vulnerability "instance."

CVSS (severity)

Common Vulnerability Scoring System—a standard scoring vulnerability severity. For prioritization, combine with EPSS (exploit probability), reachability, and asset criticality.

CWE

Common Weakness Enumeration—a classification of weakness "types" like SQL injection or buffer overflow (e.g., CWE-89). CVE is an "instance," CWE a "type."

Cyber kill chain

A model that organizes the stages of a targeted attack as reconnaissance, weaponization, delivery, exploitation, installation, command-and-control, and actions on objectives. It is used to consider effective defenses at each stage and analyze where the attack chain can be broken.

Cybersecurity Management Guidelines

Guidelines formulated by the Ministry of Economy, Trade and Industry (METI) and IPA to help business executives drive cybersecurity measures through their own leadership. They consist of three principles executives should recognize and ten important items to direct to a CISO or equivalent, framing security investment as a management issue.

Daily Scrum

A 15-minute timeboxed meeting the Developers hold each day to inspect progress toward the sprint goal and adjust the day's plan; it is not status reporting to a manager but a way for the Developers to self-organize. The 2020 Scrum Guide changed the responsible party from the 'Development Team' to the 'Developers' and makes the same-time/same-place practice recommended rather than mandatory. Colloquially called a daily standup.

DALL-E (image generation)

An Azure OpenAI model that generates images from text, creating and editing images based on prompts.

Dashboard (Power BI)

A single-screen summary collecting key metrics (KPIs) from multiple reports; created/shared in the Power BI service (reports are multi-page, dashboards single-screen).

Data / Activity Explorer

Purview tools where Data Explorer (content explorer) reveals where sensitive data resides and Activity Explorer surfaces actions taken on that data.

Data access governance (DAG) report

A report that surfaces widely shared SharePoint sites and sites with sensitivity labels to understand oversharing risk, serving as the starting point for remediation.

Data Activator

A Fabric feature that auto-triggers notifications/actions when data meets conditions (thresholds); part of Real-Time Intelligence.

Data alert

A feature that notifies when a KPI crosses a set threshold. Different in purpose from a subscription (periodic delivery).

Data assets (uri_file/uri_folder/mltable)

A reusable, versioned reference to data. Types: uri_file (a single file), uri_folder (a folder), and mltable (a schematized tabular form).

Data classification (SITs / trainable classifiers)

Data classification identifies content using sensitive information types (patterns like credit cards or national IDs) and trainable classifiers. It informs where to apply sensitivity labels and DLP.

Data collection rules (DCR)

Rules in Microsoft Sentinel/Azure Monitor defining what is collected from which sources. Used to collect Windows Security events; many servers can be aggregated first via Windows Event Forwarding (WEF).

Data compression (row/page)

Reduces storage and I/O via row and page compression. For large read-heavy tables it pairs well with columnstore for strong gains.

Data connection

Creating a connection to a source for ingest/reference; configure credentials, gateways, and privacy levels.

Data dictionary

A mechanism that centrally manages metadata such as table definitions, column types and constraints, indexes, and privileges. The DBMS generates it automatically as a system catalog, serving as the basis for queries, design changes, and access-control decisions.

Data encryption (at rest and in transit)

The practice of encrypting data both while it is stored on a medium (at rest) and while it moves across a network (in transit), as an information-leak countermeasure. Encryption at rest protects disks or files so their contents remain unreadable even if stolen or improperly removed. Encryption in transit, typically via TLS, protects the communication path from eavesdropping or man-in-the-middle tampering. Since either alone leaves part of the data's lifecycle unprotected, satisfying both is a baseline requirement.

Data exploration and performance diagnostics (DAX/T-SQL/KQL, Performance Analyzer)

Explore with the right query language: DAX (semantic-model aggregation), T-SQL (SQL analytics endpoint / Warehouse tabular analysis), KQL (Real-Time streaming/logs), plus Power BI visual exploration (slicers/drilldown). For performance issues, measure per-visual DAX query/display time with Performance Analyzer, then dig in with DAX Studio or Tabular Editor’s Best Practice Analyzer, and inspect the storage-engine (VertiPaq, fast) vs formula-engine (single-threaded, often slow) ratio. Root fixes: star schema, measure revision, V-Order/OPTIMIZE on Delta, and avoiding Direct Lake fallback. “Measure first → find cause → improve.”

Data Firehose features (buffering/transform/dynamic partitioning)

Buffering accumulates by size/time before delivery (avoiding many tiny files); Lambda transformation processes records pre-delivery; format conversion turns JSON into Parquet/ORC; dynamic partitioning splits S3 paths by content to improve Athena query efficiency.

Data governance

Control over which data may be given to AI and how to protect sensitive information; a prerequisite for safe generative AI.

Data ingestion and processing (pipelines)

Azure Data Factory / Synapse pipelines copy and orchestrate data, with mapping data flows transforming it without code; an integration runtime performs execution.

Data lake

A platform storing large amounts of raw, varied data (structured–unstructured) cheaply; schema on read.

Data lake and format optimization

An S3-centric design improving quality through raw (bronze) → cleaned (silver) → curated (gold) layers. Columnar (Parquet/ORC) + partitioning + compaction of small files cut downstream scan and cost. Use Iceberg/Hudi/Delta table formats for updates/deletes/time-travel.

Data lake tier (Sentinel)

A Sentinel data-retention tier for low-cost long-term storage of large data, used for later exploration. Distinct from the costly Analytics tier (frequent detection/investigation). Explored in batch via KQL jobs.

Data leakage

When test data, future information, pre-split fitting, or duplicate records unintentionally leak into training, inflating evaluation metrics beyond real-world performance. One of the most overlooked and most critical pitfalls in ML—always split before fit/transform, and never mix future information into time-series training.

Data Lifecycle Management and retention labels

Microsoft Purview Data Lifecycle Management uses retention labels to keep information only as long as needed and delete it afterward, balancing compliance and storage optimization.

Data lineage

The provenance of how data was produced from sources through transformations, used for impact analysis, auditing, troubleshooting, and trust.

Data loss prevention (DLP)

Detects and blocks improper sharing/sending of sensitive info such as credit card numbers.

Data loss prevention policy (Power Platform)

Classifies connectors as business/non-business/blocked to prevent sensitive data from mixing or leaking through disallowed paths; applied per environment or tenant-wide.

Data Migration Assistant (DMA)

A pre-migration assessment tool for moving SQL Server to Azure SQL and other targets; detects compatibility issues and deprecated features and checks feature parity. DMA was retired on 2025-07-16; the Azure SQL Migration extension and Azure Migrate are now recommended alternatives.

Data mining

An analytical technique that uses statistical methods and machine learning to uncover regularities, correlations, and patterns in large datasets that are hard for people to notice. Market-basket analysis — e.g., which products tend to be purchased together — is a representative example.

Data Modeling

A design technique that abstracts the structure of business information as entities and relationships, organized through conceptual, logical, and physical stages. It uses E-R diagrams to clarify cardinality and attributes between entities, forming the basis for subsequent database design.

Data pipeline (Fabric)

Orchestrates activities like Copy and notebooks (order, schedule, retry, branching) for ingestion/processing; built in the Data Factory experience.

Data profiling (column quality/profile)

Power Query features evaluating column quality (valid/error/empty), distribution (distinct/unique), and profile (min/max/average); defaults to top 1000 rows, switchable to the whole dataset.

Data protection (soft delete / immutable storage)

Features protecting data from accidental deletion or tampering. Soft delete restores deleted data within a window, versioning retains prior versions, and immutable storage (WORM, time-based/legal-hold) forbids overwrite/deletion during retention to meet compliance.

Data protection and HA/DR (backup/restore, HA/DR, PITR, LTR, geo, failover groups)

Azure SQL takes automated backups (full/differential/log). PITR restores to any point within retention (default 7 days, max 35). LTR retains weekly/monthly/yearly up to 10 years. Geo-restore restores to another region from GRS geo-redundant backups (asynchronous, larger RPO). HA is zone redundancy (in-region, across AZs); DR is active geo-replication (readable secondary in another region) and failover groups (auto-fail-over a group of DBs via listeners without changing the connection string). VM uses Always On availability groups. Design by RPO/RTO; synchronous gives RPO≈0, asynchronous covers distance.

Data quality handling (duplicate, missing, late-arriving)

Quality handling: dedup by unique key, treat missing via defaults/exclusion, and absorb late-arriving data (past records arriving later) via windows or reprocessing.

Data regions

A setting that confines Workspace stored data to a geography (e.g., US/EU) to meet residency regulations; a different axis from content-based DLP or domain-based trust rules.

Data Residency

Storing GitHub data in a specific geographic region (GHEC with Data Residency), used to meet regulatory/compliance requirements.

Data residency and sovereignty

Data residency = the geographic location (region) where data is stored; data sovereignty = data being subject to a country laws.

Data roles (admin/engineer/analyst)

A database administrator handles DB availability, security, and performance; a data engineer ingests/transforms via pipelines; and a data analyst derives insights through visualization and analysis.

Data source

Where an app reads/writes data—Dataverse, SharePoint, Excel, SQL, SaaS—connected via connectors.

Data splitting & cross-validation

Splitting data into train (fit), validation (tune), and test (final evaluation) sets to assess a model. Estimate generalization with k-fold cross-validation, split time-series data chronologically (walk-forward), and use stratified sampling for class imbalance. Getting the split wrong makes the evaluation untrustworthy.

Data structure

The way data is held and arranged so a computer can handle it efficiently. Examples include arrays (a lineup of the same type), lists (elements linked together), stacks (last-in-first-out), queues (first-in-first-out), and trees (hierarchical); the appropriate one is chosen for the purpose.

Data table (control)

A read-only control that shows records in a table (rows/columns); used for lists where a grid view fits better than a gallery.

Data temperature and tiering (hot/warm/cold)

Classifying data by access frequency to optimize cost: hot = frequent (fast, costly), warm = occasional, cold = rare (cheap, slow retrieval—Glacier). S3 lifecycle and Intelligent-Tiering move data between tiers automatically.

Data transfer costs (intra/inter-Region, egress)

An often-overlooked AWS cost. Egress to the internet is charged, ingress is free; within an AZ is free, while inter-AZ/inter-Region is billed. Traffic via NAT gateways or across AZs drives cost; VPC endpoints can cut NAT-bound transfer.

Data type conversion

Converting a column’s type (text/number/date) to the correct type; a prerequisite for correct aggregation, joins, and formatting.

Data types (INTEGER/NUMERIC/VARCHAR/TEXT/BOOLEAN/DATE/TIMESTAMP/JSON/JSONB)

PostgreSQL's major column data types. INTEGER/BIGINT hold whole numbers, NUMERIC holds arbitrary-precision numbers, VARCHAR holds variable-length strings (optionally length-limited), TEXT holds unlimited-length strings, BOOLEAN holds true/false, DATE/TIMESTAMP hold date and date-time values, JSON stores JSON as text, and JSONB stores JSON in a parsed binary form that supports indexing and faster operations.

Data utilization

The effort of analyzing data accumulated through business operations and putting it to use for management decisions and process improvement. What matters is not merely 'having' the data but connecting the analysis results to actual decisions and actions.

Data validation and processing (pre-ingestion)

Ensuring data quality before ingestion into RAG/training: dedup, format normalization, PII detection/masking, harmful-content removal, and metadata tagging, validated with (e.g.) Glue Data Quality. Preventing garbage-in underpins answer quality.

Data visualization and report types

Choose visuals by purpose (bar, line, pie, matrix, map, KPI). There are interactive reports and paginated reports formatted for printing.

Data warehouse

A platform storing shaped, structured data for analytics/aggregation; schema defined on write.

Data-driven management

A management approach that bases decisions on the analysis of data gathered from operations and the market, rather than relying solely on intuition or experience. It calls for building infrastructure to visualize and analyze data such as sales figures and customer behavior, aiming to raise the speed and accuracy of decision-making. IT strategists embed data-utilization mechanisms into business strategy and drive the creation of a structure that lets management make well-grounded decisions.

Data-oriented approach (DOA)

A methodology that designs information systems on the stable foundation of data structure, which changes less than processing. The data handled by the business is modeled and normalized with tools such as E-R diagrams, and processing functions are built on top of that data model. It assumes that processing changes often with business change while data structure stays relatively stable, serving a system architect as a basic policy for building maintainable, long-lived data assets.

Data-plane vs control-plane RBAC (Cosmos DB)

Two planes of Cosmos DB access control. The control plane manages account/config via Azure RBAC; the data plane controls read/write of items via Microsoft Entra ID-based RBAC. Token auth is preferred over account keys.

Database cluster

The entire filesystem area managed by a single PostgreSQL server instance, containing multiple databases. It corresponds to the data directory created by initdb and holds multiple databases and roles.

Database index

An auxiliary data structure that maps values of a specific column to the storage location of rows. It speeds up searches, but maintaining the index itself has a cost, so indexing a frequently updated column can slow down inserts and updates.

Database migration (assess, DMS, online/offline)

Moving from on-prem to Azure SQL. First assess (Data Migration Assistant / Azure Migrate for compatibility, target, SKU sizing), then execute (Azure Database Migration Service or the Azure SQL Migration extension; Log Replay Service for MI). Choose offline (bulk copy, downtime) or online (continuous sync with a final cutover, minimal downtime). After migrating, adjust the compatibility level and check regressions via Query Store. Pick the target by need for instance features, OS control, and tolerable downtime.

Database Migration Service (Google Cloud DMS)

Google's managed service to migrate MySQL/PostgreSQL and others to Cloud SQL or AlloyDB with continuous replication, supporting minimal-downtime cutover.

Database normalization

A design technique that progressively splits and organizes tables to eliminate data redundancy and inconsistency. It prevents update anomalies and makes it easier to maintain data integrity.

Database project

Manages warehouse schema as code for source control and diff-based deployment (a SQL project).

Database roles / users

PostgreSQL unifies the concepts of "user" and "group" into a single notion of a role. CREATE ROLE ... LOGIN creates a role that can log in (equivalent to a user), with default attributes (whether it can log in, superuser status, etc.) and an optional expiry (VALID UNTIL). ALTER ROLE changes attributes and DROP ROLE removes a role.

Database server (DB server)

The backend tier of the three-tier web model, responsible for persisting and managing data; it reads and writes data in response to queries from the AP server.

Database sharding

A design that scales by horizontally splitting data across multiple DBs (shards). The Elastic Database tools shard map manager handles routing and management.

Database user

A database-level security principal in SQL Server (and Azure SQL), mapped to a login, whose role memberships and GRANT/DENY/REVOKE determine authorization to objects. DENY is a T-SQL-specific permission state unique to SQL Server—PostgreSQL and MySQL have no equivalent. Contrasted with a contained user, which is created without a login.

Database watcher

A managed feature that collects Azure SQL monitoring data into a centralized dashboard, used for performance monitoring across multiple databases.

Database-scoped configuration

Overrides server settings per database—such as MAXDOP or legacy cardinality estimation—via ALTER DATABASE SCOPED CONFIGURATION.

Dataflow

A data-processing pipeline service supporting both batch and streaming.

Dataflow analysis (source→sink)

CodeQL analysis showing the path of "where a dangerous value enters (source) and where it can be exploited (sink)," revealing the cause, blast radius, and where to add validation/sanitization.

Dataflows

Uses Power Query to get/shape data from external sources and load it into Dataverse, etc., on a recurring basis; automates repeatable data prep.

Dataflows Gen2

A no-code transform tool using Power Query to get/shape data and write to a destination (lakehouse/warehouse); suited to small-to-medium shaping.

Dataform

A service to develop and operate SQL-based transformations (ELT) inside BigQuery with dependencies and version control.

Dataplane V2

GKE's eBPF-based networking data plane. It enforces Kubernetes NetworkPolicy (Pod-to-Pod L3/L4 traffic control) efficiently at the kernel level and also provides visibility via flow logs. It has become the default for new clusters on recent GKE versions and runs with less overhead than the older iptables-based implementation.

Dataplex and Dataplex Catalog

Dataplex is a data platform that centrally manages quality/governance across distributed data (lakes/warehouses); Dataplex Catalog discovers/organizes metadata to understand where data lives and what it means.

Dataproc

A managed service to run existing Spark/Hadoop workloads; differs in purpose from Dataflow (Beam).

Dataset

The ingested, shaped data and model (tables, relationships, measures) a report references; one can back multiple reports. In Power BI this content type was renamed to "semantic model" in November 2023.

Datastore

A reference that securely holds connection info to Azure storage (Blob/ADLS), letting you access data without re-entering credentials.

Datastream

A serverless service that stream-replicates continuous source-DB changes via change data capture (CDC); bulk minimal-downtime DB migration is Database Migration Service.

Dataverse business events

A mechanism to publish business occurrences (e.g., "order confirmed") as events for subscribers. Distinct from CRUD table-operation events.

Dataverse for Teams

A lightweight Dataverse inside Microsoft Teams; build team apps/flows/bots without extra licensing (with capacity/feature limits).

Dataverse plug-in

An extension that runs business logic server-side, synchronously/asynchronously, on Dataverse events (create/update). Distinct from client scripting (client/form UX).

Dataverse search

Full-text search across multiple tables returning relevance-ranked results, helping users quickly find records in model-driven apps and Power Pages.

Dataverse security scope (teams/business units/row sharing)

Dataverse access scoping: teams (groups of users) and business units (org hierarchy) scope security roles; row sharing shares individual records exceptionally.

Dataverse Web API

An OData v4-based REST API to operate Dataverse over HTTP from any-language clients (Xrm.WebApi). Distinct from the server-side Organization service.

Date and time column

A column storing dates or date-times; configure date-only vs date-time and time-zone behavior.

Date dimension

A dedicated dimension of contiguous dates and calendar attributes (year/quarter/month/weekday); the prerequisite for time intelligence (e.g., YoY).

Date picker

A control to pick a date from a calendar; used for date columns to avoid format issues and invalid dates.

Date table

A contiguous date table required for time intelligence, used via Mark as date table.

Date/time functions (age/now/current_date/current_timestamp/extract/to_char)

Functions for working with date/time values: age computes the difference between two timestamps, now/current_timestamp return the current time, current_date returns the current date, extract pulls a component (year, month, day, etc.) out of a date/time value as a numeric double precision value, and to_char formats a date/time as a string.

DAX (Data Analysis Expressions)

The expression language for measures and calculated columns in a semantic model; evaluated via row context and filter context.

DAX performance improvement

Making slow DAX faster: use variables to avoid re-evaluation, reduce iterators, optimize filters, and adopt a star schema.

DAX Studio

An external tool to run, time, and trace DAX queries; server timings reveal the storage-engine vs formula-engine breakdown.

DAX variables (VAR)

Using VAR to store intermediate results and RETURN to return them; improves readability and avoids re-evaluating the same calculation.

DB parameter group

A template that groups DB engine settings (max connections, timeouts, character set, etc.). Dynamic parameters apply immediately, but changing a static parameter requires an instance reboot to take effect—a common exam distinction.

DBMS (Database Management System)

Software that centrally manages data storage, retrieval, updates, concurrency control, and recovery. It shields applications from direct file manipulation, guaranteeing consistency, durability, and concurrency control through a standard interface such as SQL.

DDoS attack types (L3/L4 vs L7)

L3/L4 attacks saturate links/resources with volumetric packets (SYN flood, reflection/amplification)—absorbed by Shield/NLB/scrubbing. L7 attacks exhaust the app with legitimate-looking requests—mitigated by WAF rate-based rules and Shield Advanced. Layer defenses by tier.

De jure standard and de facto standard

A classification of standards by how they come into being. A de jure standard is established through the formal procedures of an official standards body such as ISO or JIS, while a de facto standard becomes the effective standard through widespread market adoption and share, without going through an official certification process.

De Morgan's laws

Laws describing how negation distributes over logical operations. The negation of "A and B" equals "not A or not B" (NOT(A AND B) = NOT A OR NOT B), and the negation of "A or B" equals "not A and not B" (NOT(A OR B) = NOT A AND NOT B). They are used to simplify logical expressions and rewrite conditional expressions.

Dead-letter queue (DLQ)

A dedicated queue that captures messages which failed processing a set number of times, used for investigation and reprocessing and to keep poison messages from clogging the main queue; maxReceiveCount sets the redrive threshold.

Deadlock

A state in which multiple transactions each wait for a lock held by the other, so none can proceed. PostgreSQL automatically detects deadlocks and resolves them by forcibly rolling back one of the transactions.

Deadlock

A stalemate in which multiple processes or transactions each wait for a resource held by another, so none can proceed. It arises when the four conditions of mutual exclusion, hold-and-wait, no preemption, and circular wait hold simultaneously; countermeasures include prevention by unifying the resource acquisition order, avoidance by scheduling resource requests, and detection via a wait-for graph followed by rolling back one party. The architect designs lock granularity and acquisition order to suppress deadlocks.

deadlock_timeout

A parameter setting how long a transaction waits on a lock before PostgreSQL runs deadlock detection. A larger value reduces detection overhead but delays discovering a deadlock; a smaller value has the opposite trade-off.

Decision tree

An interpretable model that repeatedly branches on feature thresholds and predicts at the leaf nodes. Used alone, it tends to overfit the training data and needs depth limits or pruning to control—but it works for both regression and classification.

Decision tree (decision analysis)

A management science technique that represents multiple options and their outcomes as a tree diagram, computing the expected value of each branch from its probability and payoff to guide optimal decisions. Used to evaluate investment decisions and project choices under uncertainty by comparing the expected value (sum of probability times payoff) of each branch.

Decomposition tree

An AI visual that drills a measure down by dimension to decompose contributors, with AI suggesting the next dimension to split by.

Dedicated Host

An EC2 placement option that dedicates an entire physical server to one customer. Sockets, cores, and the host ID are visible, which matters when bringing your own socket/core-based software licenses (BYOL). It costs more than Dedicated Instances but lets you control instance placement on the same host.

Dedicated Instance

An EC2 instance placement that runs on hardware not shared with other AWS accounts' tenants. It is physically isolated but, unlike a Dedicated Host, gives no host-level visibility (socket/core IDs). Chosen when compliance requires physical isolation but licensing doesn't require host visibility.

Deep learning

Methods using multi-layer neural networks; strong on complex data like images, audio, and language.

Deep learning architectures (CNN/RNN/Transformer)

Choose by data structure. CNN = convolution + pooling for local features in images/spatial data (classification, detection). RNN/LSTM = memory across steps for sequences/time series (order matters, but hard to parallelize and weak on long range). Transformer = self-attention captures long-range context in parallel, strong for language/long sequences (BERT/GPT; cost is quadratic in length).

Deep packet inspection (DPI) and packet filtering

Packet filtering is a lightweight inspection method that decides pass/block by looking only at header fields (IP address, port, and the like). Deep packet inspection (DPI) goes further and analyzes the payload itself, letting it identify the application in use or detect malicious content — at the cost of much higher processing overhead.

Default editor (EDITOR / nano / emacs)

Which editor crontab -e and similar launch is set by the EDITOR variable (export EDITOR=nano). nano shows keys on-screen (beginner-friendly), and emacs is another major editor.

Default environment

One environment auto-created per tenant; accessible to all users and often used for personal prototyping—dedicated environments are recommended for production.

Default route (0.0.0.0/0)

The catch-all route in a route table for destinations that match no more-specific route. In public subnets it points to an IGW; in private subnets to a NAT gateway—deciding the egress path.

Default route (default gateway)

The exit for packets destined outside your network; check with ip route (or route -n)—without it nothing leaves the local segment. Fix a wrong routing table with ip route del/add default.

Default security configuration

A template of "which features to enable with which settings." Applied to an org, it applies uniformly to targeted repos and inherits to repos created later. Choose GitHub-recommended or org custom.

default_statistics_target / effective_cache_size

Key planner-related parameters. default_statistics_target is the default controlling the precision (MCV/histogram resolution) of statistics ANALYZE collects. effective_cache_size is an estimate of the effective cache size, including the OS filesystem cache, influencing how favorable Index Scan looks to the planner.

Defender CSPM

Cloud Security Posture Management. Surfaces config weaknesses as recommendations, visualizes connected risk via attack path analysis, and finds hard-coded secrets via secret scanning—proactive posture, a separate pillar from runtime threat detection (CWP).

Defender for Cloud DevOps security

Connects GitHub, Azure DevOps, and GitLab to Defender for Cloud to detect misconfigurations, exposed secrets, and vulnerabilities in code and pipelines.

Defender for Containers

A Defender plan that detects container misconfigurations and runtime risks (suspicious processes, known exploits). Complements image vulnerability scanning and trusted-image allowance in ACR.

Defender for Databases

Provides threat protection across Azure database services, detecting suspected SQL injection, anomalous logins, and unusual sensitive-data access (formerly Advanced Threat Protection). Distinct from SQL auditing, which records.

Defender for Key Vault

A threat-protection plan that detects anomalous access patterns to a Key Vault (unusual locations, bulk retrieval) at runtime. Distinct from Defender CSPM secret scanning, which proactively finds hard-coded secrets.

Defender for Servers

Provides VM vulnerability scanning (Defender Vulnerability Management), EDR (Defender for Endpoint integration), agentless scanning, and JIT VM access. Extends to on-prem and AWS/GCP servers via Azure Arc.

Defender Vulnerability Management

Continuously detects known vulnerabilities (CVEs) on VMs and containers, with prioritization and remediation guidance, built into Defender for Servers/Containers.

Defense in depth

Layering protections so that if one is breached the next still holds (identity, network, data, etc.).

Degree and cardinality

In the relational model, degree is the number of attributes (columns) in a table, and cardinality is the number of tuples (rows). Degree is fixed at schema-design time and normally stable in operation, while cardinality changes as data is added or removed.

Delegated administrator

A mechanism that delegates organization-wide administrative rights for supporting services (GuardDuty, Config, Security Hub, etc.) to a member account other than the management account. It minimizes use of the management account and lets a security operations team hold separated duties; it must be configured per service.

Delegated bypass / delegated exceptions

A mechanism to temporarily bypass a block (e.g., Push Protection) or grant a policy exception with approval; control who may approve via access management and record for auditability (not a permanent waiver).

Delegated vs application permissions (API permissions)

Delegated permissions act on behalf of the signed-in user and never exceed their rights; application permissions act as the app alone, are powerful, and require admin consent. Background daemons use application permissions.

Delegation

Pushing filtering/sorting to the data source instead of the app, so large datasets work correctly and fast; using non-delegable functions may process only part of the data.

DeletionPolicy (Retain/Snapshot)

A CloudFormation attribute specifying what happens to a resource on stack delete/replace: Retain (keep), Snapshot (snapshot then delete), or Delete (default). Used to protect databases/buckets from accidental deletion.

Delivery Optimization

A Windows bandwidth-optimization feature that lets devices fetch Windows Update and app content from peer devices on the same network/organization, not just the internet or Microsoft's cloud. It reduces load on WAN links and speeds up update rollout in environments with limited inter-site bandwidth.

Delivery semantics (at-least-once/exactly-once)

Guarantee levels for message delivery: at-least-once = may duplicate (standard SQS—needs idempotent handling); exactly-once = no duplicates or loss (SQS FIFO); at-most-once = may drop but no duplicates. Designs tolerate duplicates via idempotency.

Delta table (Delta format)

Fabric’s default table format: Parquet plus a transaction log enabling ACID, time travel, and schema management; OneLake tables are stored this way.

Demand management

Demand management is the activity of forecasting demand for a service and optimizing resource use by smoothing peaks (peak shifting). By curbing variability in demand through means such as differential pricing or steering usage to off-peak times, it avoids excessive capital investment while preventing capacity shortfalls. It works closely with capacity management, combining demand-side smoothing with supply-side augmentation. The IT service manager analyzes demand patterns and judges by cost-effectiveness whether to increase supply capacity or to smooth demand.

Denormalization

Deliberately joining/redundifying normalized tables to speed reads/analytics; common in analytics platforms to cut join cost.

Dependabot

Alerts on vulnerable dependencies and auto-opens PRs for security/version updates.

Dependabot alerts and security updates

Dependabot alerts notify of known dependency vulns (Advisory/CVE); security updates auto-create PRs to safe versions; version updates keep deps current regardless of vulns (the two differ).

Dependencies (packages)

Other packages a package needs to function; apt/yum resolve them automatically and install together, while dpkg/rpm do not and fail when a dependency is missing.

Dependency graph

Parses manifests/lockfiles to list the packages a repo depends on, including transitive dependencies; it underpins Dependabot alerts and Dependency Review.

Dependency Review

A gate-based prevention that inspects a PR’s added/updated dependency diff before merge and blocks vulnerable deps or disallowed licenses; can be a required check.

Deploying to App Service

Ways to deploy code or containers to App Service (ZIP deploy, container deploy, CI/CD); combine with slots for zero downtime.

Deployment Manager

Google Cloud's native Infrastructure as Code service (YAML/Jinja/Python templates). It is deprecated and reaches end of support on 2026-03-31; migrate to the Terraform-based Infrastructure Manager or another IaC tool.

Deployment model

Classification of cloud placement: public (shared), private (dedicated), and hybrid (combining both).

Deployment pipeline (Fabric)

A release feature that promotes artifacts across dev→test→prod stages with diff comparison and deployment rules; prevents manual-deploy mistakes.

Deployment scenarios (GHEC/EMU/Data Residency/GHES)

Deployment options chosen by requirements: GHEC with EMU (fully managed IDs), GHEC with Data Residency + EMU (pinned data location), GHEC with personal accounts, and GHES (fully self-hosted).

Deployment slots

In App Service, deploy to a separate environment (e.g., staging) and swap after warm-up for zero-downtime releases, with easy rollback.

Deployment strategies (blue/green, canary)

Ways to release a new version: all-at-once (downtime risk), rolling (batch updates), blue/green (switch to a new env, easy rollback), canary (ramp from a small slice). Choose by the speed-vs-safety trade-off.

Deployment strategies (canary/blue-green/rollback)

Canary = release to a subset first; blue/green = instant switch between old/new environments; rollback = revert quickly on issues. Risk-limiting release techniques.

Design patterns (GoF patterns)

Reusable solutions to recurring problems in object-oriented design, catalogued as 23 patterns by the Gang of Four (GoF). They fall into three categories: creational patterns (Factory Method, Singleton, Builder, etc.), structural patterns (Adapter, Facade, Proxy, etc.), and behavioral patterns (Observer, Strategy, State, etc.). A system architect uses them as a shared vocabulary to convey design intent and to secure quality and maintainability through proven structures.

Design review (walkthrough, inspection)

An activity in which stakeholders verify design artifacts to find errors and problems early. A walkthrough is an informal review in which the author leads by explaining the artifact while participants point out issues, with light preparation. An inspection is a formal review led by a moderator with roles assigned to participants, systematically detecting and recording defects against a checklist, giving high detection power. The architect chooses the review form by the importance of the target to prevent defects leaking into later phases.

Design studio (Power Pages)

Power Pages’ site-building editor with Pages, Styling, Data, and Set up workspaces to compose a site low-code.

Design thinking

An approach to creating new products and services that starts from the user's (customer's) viewpoint, deeply observing and empathizing with what they truly struggle with or want. It is characterized by rapidly repeating prototyping and testing to improve, thinking from a human-centered rather than technology-centered starting point.

Desktop flow

A Power Automate flow that uses RPA to record/replay UI actions (clicks, typing), automating even legacy apps without APIs; built in Power Automate for Desktop.

Detailed monitoring

An option that raises EC2 metric collection from the standard 5-minute interval to 1 minute (extra cost); finer high-resolution metrics can be sent at down to 1-second granularity.

Detection risk

The risk that the auditor's own procedures fail to detect a material misstatement or weakness. Unlike inherent and control risk, which the auditor merely assesses, detection risk is the one component the auditor can actively manage by adjusting the nature, extent, and timing of procedures (for example, how much sampling versus full examination to use). Where inherent and control risk are high, the auditor must drive detection risk lower.

Developer environment

A free personal environment for learning/development (formerly Community plan); try features on your own.

Developer portal (APIM)

An auto-generated portal for API consumers offering documentation, try-it, and subscription sign-up.

Development Team (Scrum)

The people who build the increment in Scrum, self-organizing to do the work needed for the sprint goal. The 2020 Scrum Guide removed the separate "Development Team" sub-team and redefined them as the "Developers" who, together with the Product Owner and Scrum Master, form the single Scrum Team. They are not assigned work from outside; the Developers themselves plan and divide how to realize the sprint backlog. They are cross-functional, spanning design, implementation, and testing.

Device compliance

The state of a device meeting Intune policy requirements (encryption, OS version, passcode, etc.). Combined with Conditional Access to allow access only from compliant devices.

Device compliance policy

Evaluates compliant/noncompliant whether a device meets requirements like encryption and minimum OS (Conditional Access enforces on the result; evaluation and enforcement are separate layers).

Device configuration profile

Centrally distributes settings (language, security) to devices from Intune (distributes settings—distinct from a compliance policy that evaluates).

Device driver

A software layer that abstracts the register-level operations needed to control a specific piece of hardware (a sensor, a communication module, etc.) and presents a uniform interface to application software above it. By hiding hardware details from the application, it confines the impact of a hardware change to the driver layer, improving portability and maintainability.

Device management (udev/sysfs/D-Bus)

udev detects hot-plug events and dynamically creates/names device files in /dev; sysfs (/sys) is the device tree the kernel exposes, and D-Bus is the IPC that notifies desktops and services of events.

Device management levels (basic / advanced)

The strength of endpoint management. Basic = minimal control without enrollment; advanced = strong control (screen lock, encryption, wipe) after enrollment. Applied differently to company-owned vs personal (BYOD) devices.

Device Redundancy and Path Redundancy

Device redundancy deploys duplicate devices performing the same function (e.g., a virtual gateway via VRRP/HSRP, or dual power supplies and fans), automatically failing over to the surviving unit if one fails. Path redundancy provisions physically distinct transmission paths (links or switch paths) so that routing protocols or STP automatically reroute traffic if one path fails. The two address different failure domains: device-level availability versus link/path-level availability.

Device registration

A method that registers a personally-owned device (BYOD) with Entra ID, giving the device an Entra ID identity for accessing company resources without placing the device itself under organizational management. Typically registered with a personal account, with app-level protection applied via MAM (mobile application management). Its management scope differs from Entra join / hybrid join, which manage the entire device.

Device tags

Labels to group Teams devices by location/purpose for bulk management/filtering. Distinct from configuration profiles (applying common settings).

Devil's river, valley of death, and Darwinian sea

A metaphor in management of technology (MOT) for three barriers a basic research result must clear to succeed as a business. The 'devil's river' is the gate from basic research to product development; the 'valley of death' is the wall of funding and organization needed to commercialize the developed product; the 'Darwinian sea' is the stage where the launched product faces competitive and market selection.

DevNet Sandbox

A free hands-on environment Cisco provides for developers. Always-on and reservable sandboxes let you try the APIs and NETCONF/RESTCONF of platforms like Meraki, Catalyst Center, and ACI without owning real hardware, and together with Code Exchange (shared sample code), Learning Labs, and the API docs they form the core of DevNet's resources.

DevOps

A philosophy and culture in which development and operations collaborate closely, using automation and CI/CD to deliver software faster and continuously.

DevSecOps

The practice of building security verification into the earliest stages of development rather than bolting it on after release (shift left). Automated vulnerability scanning and code review are embedded in the CI/CD pipeline so defects are found and fixed while they are still cheap to fix.

DHCP

A protocol that automatically assigns the network settings a device needs — including an IP address — when it connects to the network, saving an administrator the trouble of manually configuring an IP address on every device.

DHCP relay agent

Because DHCP DISCOVER and similar messages are broadcasts that do not cross routers, a relay function (IP helper) is configured on each segment's router (default gateway) so clients on a server-less segment can use a server on another segment. It relays received DHCP broadcasts to the specified server as unicast, letting one server serve multiple subnets.

DHCP Scope Design

The design of a DHCP server's address pool (scope) per subnet, including exclusion ranges, lease duration, and accompanying options such as default gateway and DNS server. Key considerations are carving out exclusion ranges for fixed allocations or other reserved uses, and balancing concurrent client count against lease duration to avoid address pool exhaustion.

DHCP snooping

A switch feature that classifies ports as trusted (connected to a legitimate DHCP server) or untrusted (general endpoints) and discards DHCP server replies (OFFER/ACK) arriving on untrusted ports, preventing a rogue DHCP server from distributing a fake gateway (a man-in-the-middle attack).

DHCP starvation

A DoS attack in which an attacker exhausts a DHCP server's address pool by requesting addresses with a flood of spoofed MAC addresses, leaving none available for legitimate clients. Countermeasures include limiting DHCP requests per switch port and using DHCP snooping.

DHE / ECDHE (ephemeral key exchange)

Performing Diffie-Hellman key exchange with an ephemeral key pair per session (ECDHE is the elliptic-curve variant). Because the long-term key is not used for key agreement, it achieves forward secrecy (PFS); it replaces static RSA key exchange as the basis of TLS 1.3.

Diagnosing from error messages (FATAL/PANIC/ERROR)

PostgreSQL log entries (routed via log_destination) carry severities that escalate: DEBUG (developer-level detail) < LOG (operational information) < NOTICE (mild advisory to the user) < WARNING (unexpected but processing continues) < ERROR (aborts the current statement and its transaction) < FATAL (terminates the current connection/session) < PANIC (the most severe level, which resets the entire server by taking down all backend processes and triggers an automatic restart to avoid suspected shared-memory corruption). Messages like could not write to file (write failure) or out of memory typically signal OS resource exhaustion.

Diagnostic settings

Configuration that routes a resource's logs/metrics to a destination (Log Analytics workspace, storage account for long-term archive, or Event Hub for external SIEM integration). Resource logs are not aggregated by default unless diagnostic settings route them—unlike the activity log, which is recorded automatically per subscription. Data collection rules (DCRs) let you fine-tune what's collected and how it's transformed.

Diagnostics and logging (App Service)

Collecting app/web-server/detailed-error logs and viewing the live log stream; integrates with App Insights for monitoring.

Diamond Model

A forensic analysis model for examining a single intrusion event in terms of four vertices — adversary, capability, infrastructure, and victim — and the relationships among them. Where the cyber kill chain tracks a chronological sequence of stages, the Diamond Model instead focuses on the relationships among the elements of one attack event.

Differential backup

A backup method that copies only data changed since the last full backup. Restoring needs just the full backup plus the most recent differential, but the differential grows larger each day since the last full backup.

Diffusion of innovation (adoption curve)

A theory that classifies how a new product or technology spreads through a market into five adopter categories, in order of adoption speed: innovators, early adopters, early majority, late majority, and laggards. Strategists use it to judge which adopter segment the product is currently reaching, shifting from measures that appeal to innovators' and early adopters' taste for novelty in the early market to measures emphasizing track record and reliability once the product moves toward the majority.

Digital certificate

An electronic certificate issued by a certificate authority (CA) that binds a public key to its owner and vouches for that binding. A web server's certificate is what a browser verifies during an HTTPS connection to confirm the site is not impersonated.

Digital forensics

The technique and procedure for collecting, preserving, and analyzing records left on computers or network devices — logs, disk images, memory dumps — after an incident, in a manner that holds up as legal evidence. Recording hash values to avoid altering the original and maintaining a chain of custody are essential.

Digital Signal Processor (DSP)

A processor optimized to repeatedly execute multiply-accumulate (MAC) operations at high speed in hardware. It is used for real-time numeric workloads such as filtering, FFT, and signal conditioning of audio, image, or sensor data. The key design decision is offloading computation that a general-purpose MCU cannot finish in time to a DSP with dedicated pipelines and parallel MAC units.

Digital signature

A technology that uses public-key cryptography to prove both that an electronic document was created by the claimed author (authenticity) and that the document has not been tampered with (integrity).

Digital transformation (DX)

Using digital technologies such as cloud to reshape products, services, and operations themselves, creating new value and customer experiences.

Digital twin

A virtual model of a real-world facility, product, or process, kept synchronized in real time using data collected via IoT sensors and reproduced in a virtual space. Through simulation it enables predicting operating conditions, detecting anomalies early, and verifying the effect of improvements before making changes in the real world. IT strategists consider using digital twins to support decisions on capital investment or process improvement while reducing the cost and risk of prototyping or halting live operations.

Digitization and digitalization

Terms describing stages on the path to DX. Digitization is the stage of converting existing operations and information into digital form as-is, such as scanning paper documents. Digitalization is the stage of using digital technology to transform the business processes or customer touchpoints themselves — going beyond mere digital conversion, unlike digitization.

Dimension table

A table of analysis perspectives/attributes (date, product, customer); joined one-to-many to the fact, serving as filter/group axes.

Dimensional modeling / star schema (fact, dimension, SCD)

Data design for analytics/BI. A star schema places dimension tables (date/product/customer perspectives) radially around a central fact table (numeric measures + foreign keys)—denormalized for fast BI. For a fact, first set the grain (what one row represents). Dimensions use a surrogate key (system-generated integer) as primary key, separate from the business key, to stabilize joins/history. SCD (Slowly Changing Dimension) handles attribute change: Type 1 (overwrite, no history), Type 2 (add rows to keep history), Type 3 (keep prior value in a column). A date dimension (contiguous dates) underpins time intelligence. A snowflake (further normalized) adds joins and often hurts BI performance.

Direct Connect architecture (VIF / DX Gateway / LAG)

A virtual interface (VIF) is the logical connection unit over Direct Connect: a private VIF to a VPC, a public VIF to AWS public services, and a transit VIF to a Transit Gateway. A Direct Connect Gateway connects multiple Regions/VPCs together, and a LAG (link aggregation group) bundles physical links for more bandwidth (resiliency is separate—use multiple locations).

Direct Connect resiliency (BFD)

For production, use high/maximum resiliency models with multiple locations and devices. BFD (Bidirectional Forwarding Detection) speeds failure detection and shortens failover.

Direct Connect vs. VPN

Comparing on-prem connectivity. Site-to-Site VPN is cheap and instant over the internet but has variable bandwidth/latency; Direct Connect is a dedicated link—stable, low-latency, high-bandwidth—but slower and costlier to set up. Critical links pair DX with VPN as backup.

Direct Lake

A Power BI semantic-model mode that reads OneLake Delta tables directly and fast—neither import nor DirectQuery; unsupported features fall back to DirectQuery.

Direct Lake fallback

When Direct Lake hits unsupported situations (certain features/limits), it auto-switches to DirectQuery; avoiding this fallback is tested.

Direct Lake on OneLake

The Direct Lake execution path where column data from OneLake Delta tables is read without going through the SQL analytics endpoint, transcoded into memory for the VertiPaq engine on-demand at query time. Contrasted with Direct Lake on SQL. Whether it's used by default and how many feature restrictions apply depend on situational factors at model-creation time (fallback conditions, supported feature scope)—it isn't uniformly true that it always has fewer restrictions and is always the higher-performance default.

Direct Memory Access (DMA)

A scheme in which a dedicated DMA controller transfers data directly between memory and a peripheral without CPU involvement in each transfer. The CPU can continue other work after initiating the transfer, greatly reducing CPU load for bulk data movement. However, DMA transfers occupy the memory bus, which can contend with CPU memory accesses and introduce execution-time variability.

DirectLake mode

A Power BI storage mode that reads Parquet directly on a Microsoft Fabric lakehouse/OneLake, giving Import-like performance on large data without refresh. Distinct from Import (load) and DirectQuery (query source).

Directories and file management

The OS mechanism for organizing and storing files. A directory (folder) is a container that groups files, and files are managed in a hierarchy where directories can contain further directories. File management specifies the location of a target file using paths (absolute and relative) that trace this hierarchy.

Directory settings

Settings that govern how users/contacts are shared within the org—controlling what appears in the directory and whether external contacts can be shared.

Directory traversal

An attack that injects sequences such as "../" into a web app's file-reference parameter to illegitimately access files in parent directories that should not be exposed (config files, password files). Input validation and path canonicalization are countermeasures.

DirectQuery mode

Queries the source on each request; always live but depends on source performance and is generally slower than Import.

Dirty read

A read anomaly in which a transaction reads changes made by another transaction that has not yet committed (and might still roll back). It can occur only under the READ UNCOMMITTED isolation level and is prevented at READ COMMITTED and above.

Disaster preparedness (alternate site and redundancy)

Measures to keep IT services running even if the primary site is damaged by a disaster such as an earthquake or fire: securing a geographically separate alternate site (backup site) and making servers and network links redundant. Whether the alternate site is kept warm/hot at all times or built only after a disaster trades off recovery speed against cost, and the chosen level is driven by the RTO/RPO targets.

Discretionary Access Control (DAC)

An access-control model in which the owner of a resource decides at their own discretion who gets what access. It is flexible but vulnerable to a careless or mistaken grant by the owner, in contrast to mandatory access control (MAC), where the system centrally enforces the decision.

Disk encryption (BitLocker)

Encrypts Windows disks and securely stores/retrieves recovery keys in Intune; self-service recovery lets locked-out users retrieve their own recovery key.

Disk striping

Combining multiple managed disks to sum IOPS/throughput/capacity, used for SAP/HANA performance needs beyond a single disk’s limits. Distinct from a single simple volume.

Distributed Database

A system that partitions or replicates data across physically separate sites while presenting a single logical database to users. Horizontal/vertical partitioning and replication improve availability and performance, but coordinating updates across sites requires mechanisms such as two-phase commit.

Distributed tracing and Application Map

Tracks a request across services via correlation IDs and visualizes dependencies/latency on the Application Map.

Distributed training (Reduction Server/Horovod) and hyperparameter tuning

Means to make large-scale training efficient: Reduction Server offloading GPU data-parallel gradient aggregation (all-reduce) to dedicated nodes, framework-agnostic Horovod, and hyperparameter tuning (Vertex AI Vizier) to raise accuracy. Choose accelerators by workload (large TF/JAX=TPU, general=GPU, on-device=edge).

Distributed transparency

In a distributed database, the property that users and applications can treat the system as if it were a single database, without being aware of the physical distribution of data. Its forms include location transparency, replication transparency, and fragmentation transparency.

Distributed version control

A model where each developer holds a complete copy of the history, so committing and browsing work offline.

Distribution

A packaged form distributing the Linux kernel together with package management, tools, and configuration; the Debian/Ubuntu family (apt) and the RHEL/CentOS family (yum/dnf) differ in management commands and defaults.

DLP (Data Loss Prevention)

A mechanism that monitors channels such as email, copying to USB drives, and uploads to cloud storage, detecting, warning about, or blocking the outbound movement of data matching patterns for confidential or personal information. It is used to prevent information leaks caused by insider misconduct or operator error.

DLP rules (Workspace)

Rules that detect sharing/sending of sensitive information in Drive or Gmail and warn or block. You configure detectors (predefined/custom) and actions (warn, block, audit).

DMZ (demilitarized zone)

An intermediate network segment placed between an external network and an internal network. Servers exposed to the outside, such as web or mail servers, are placed here so the internal network is never accessed directly from outside.

DNS

A distributed directory service that translates between domain names (such as example.com) and IP addresses, running on port 53 so a destination can be addressed by a human-readable name. A name-resolution failure is a common way application connectivity breaks, and needs to be ruled out separately from whether the correct IP is reachable.

DNS (Domain Name System)

A mechanism that maps human-friendly domain names (e.g., example.com) to IP addresses, so that a user need only type a domain name to automatically reach the IP address of the corresponding server.

DNS / name resolution (record types)

Translates domain names to IPs. Key records: A (IPv4), AAAA (IPv6), CNAME (alias; not at apex), MX (mail), TXT (verification), NS (delegation). AWS Alias records are a CNAME alternative that can point to AWS resources at the apex; TTL controls cache duration.

DNS cache poisoning

An attack that injects forged name-resolution results into a caching DNS server so users are directed to an attacker-controlled fake site. It works by racing a forged response — guessing the query's transaction ID and source port — to the resolver before the legitimate authoritative server's real reply arrives, so the forged answer gets cached. Countermeasures include randomizing the source port and transaction ID, and DNSSEC, which cryptographically signs and validates responses.

DNS client config (host / dig / resolv.conf)

Configuring and checking name resolution: nameserver in /etc/resolv.conf sets the DNS servers, /etc/nsswitch.conf the lookup order (usually files->dns), and /etc/hosts holds static entries. host/dig query DNS directly (dig selects a server with @), while getent resolves following nsswitch order (including /etc/hosts).

DNS Delegation and Zone

A zone is the portion of the DNS namespace for which a specific set of authoritative servers holds management responsibility. Delegation is the mechanism by which a parent zone's name server hands off authority for a subdomain to another name server via NS records, enabling hierarchical, distributed administration where the delegated portion becomes an independent subzone.

DNS resource records and reverse lookup

Information registered in a DNS zone: A/AAAA (hostname to IP), MX (mail destination plus preference), CNAME (alias), NS (delegation), PTR (reverse lookup IP to hostname), TXT (e.g., SPF), etc. Reverse lookup places PTR records in an in-addr.arpa zone (ip6.arpa for IPv6) with the IP address reversed, realized by receiving delegation of that IP block's reverse zone.

docker (container runtime)

A runtime/tool to create, start, and stop containers; docker run launches from an image, docker start / docker stop operate on existing containers.

Docker image

A read-only template used to start containers. It is built from a Dockerfile with docker build, or created from a running container's state with docker commit. Images are fetched from a registry with docker pull, listed with docker images, and removed with docker rmi.

Docker registry

A server that stores and distributes Docker images. Docker Hub is the default public registry; images are fetched and published with docker pull/docker push. Organizations can also run their own private registries.

Dockerfile

Docker is the leading platform for building and running containers. A Dockerfile is the text file describing how to build a container image, stacking instructions such as FROM (base image), RUN (commands executed at build time), COPY (place files), CMD (the startup command), and EXPOSE (the port to publish) to define the image, which docker build then turns into an image and docker run executes.

Document AI

A service that extracts information such as amounts and dates from documents like invoices and contracts to automate document processing.

Document Intelligence custom/composed models

Custom models trained on your own forms (template or neural) and a composed model that bundles multiple custom models and routes automatically.

Document Intelligence prebuilt/layout models

Prebuilt models that extract common documents (invoices, receipts, IDs) with no training, and a layout model that extracts tables, selection marks, and structure.

Document review method

An audit technique in which the auditor examines documents such as policies, manuals, design specifications, minutes, and records to confirm both the design of controls (whether rules are properly established) and their operation (whether records are actually created and retained). It can verify consistency on paper, but whether practice matches documentation must be corroborated with other procedures.

Document translation and custom translation

Translator’s document translation translates files while preserving formatting, and Custom Translator trains/publishes a model adapted to domain-specific terms using parallel data.

Document-oriented database

A NoSQL model that stores data as semi-structured documents (e.g., JSON-like). Its flexible, per-document schema lets different documents hold different fields, suiting hierarchical or variable-structure data.

Domain

The set of values an attribute may take. For example, a "gender" attribute might have the domain {male, female, other}. Explicitly defining domains prevents invalid values and keeps data consistent.

Domain (Fabric)

A logical group bundling related workspaces by business area (sales, finance), enabling data-mesh-style decentralized governance with per-domain defaults and delegated admins.

Domain-driven design (DDD)

A design approach that places the domain model at the center of the design and builds the software around it. A ubiquitous language shared by developers and domain experts aligns understanding, and bounded contexts delimit where each model applies, taming the complexity of large systems by divide-and-conquer. The architect decides how to draw context boundaries so they align with service decomposition and organizational structure.

DORA (DHCP four-message exchange)

The acronym for DHCP's four-step message exchange when assigning an IP address: the client's broadcast Discover, the server's Offer, the client's Request confirming its choice, and the server's Acknowledge. When renewing an existing lease, the exchange can skip Discover/Offer and use only Request/ACK.

DORA metrics

Four delivery-performance metrics. Speed = deployment frequency, lead time for changes; stability = change failure rate, MTTR (mean time to restore). Great DevOps raises all four simultaneously (speed and stability coexist).

DoS and DDoS

A DoS (denial of service) attack renders a service unresponsive from a single attacking source. A DDoS (distributed DoS) attack launches the same effect from many compromised hosts (such as a botnet) simultaneously, spreading the sources so that simply blocking one source does not stop it — making response much harder.

DoS/DDoS attack

An attack that overloads a server or network with a flood of requests or malformed packets so that legitimate users cannot use the service (DoS = denial of service). A DDoS (distributed DoS) launches the attack simultaneously from many devices infected with malware (a botnet), so the sources are dispersed and cannot be stopped by simply blocking one source. It harms availability rather than the confidentiality of information.

DoS/DDoS attacks and SYN flood attacks

A DoS attack overwhelms a service by flooding it with excessive requests or malformed packets from a single source. A DDoS attack is a distributed DoS carried out simultaneously from many compromised hosts (e.g., a botnet), making it hard to block since sources are spread out. A SYN flood attack is a representative DoS technique that abuses the TCP three-way handshake, sending a flood of SYN packets without completing the handshake, leaving the server with many half-open connections and exhausting its resources; SYN cookies are a common countermeasure.

dpkg (direct deb handling)

The low-level tool beneath apt, handling deb files directly (-i install, -r remove, -P purge). It resolves no dependencies. Query with -l list, -L package->files, -S file->package. dpkg-reconfigure re-runs a package interactive setup.

DR strategies (backup/warm/hot standby)

With loose RTO/RPO, choose cheap backup-and-restore; with strict targets, warm standby (scaled-down on standby) or hot standby (fully running redundancy). RTO=recovery time, RPO=acceptable data loss.

DR strategies (four)

Backup & restore (cheap/slow) → pilot light → warm standby → multi-site (costly/fast); shorter RTO/RPO costs more. Use cross-region replication + Route 53 failover for region-wide failures.

DR testing

The practice of verifying that a disaster recovery plan actually works, through backup-restore checks and failover drills that measure real RTO and RPO against targets, surfacing gaps between the plan and reality. Without regular exercise, a DR plan tends to become stale and unreliable.

DR/BDR/DROTHER (OSPF)

A mechanism OSPF uses on multi-access networks (such as Ethernet) to avoid a full mesh of adjacencies among every router. The router with the highest priority is elected DR (Designated Router), the runner-up becomes BDR (Backup Designated Router), and every other router (a DROTHER) forms a full adjacency only with the DR and BDR, exchanging routing information indirectly through the DR. This greatly reduces the volume of LSA exchange.

Drain mode

A state that stops accepting new sessions and evicts existing users before swapping session hosts for updates/maintenance. Pooled updates follow the cycle: publish a new image version → drain → recreate session hosts.

Drilldown

Descending a hierarchy (year→quarter→month) one level at a time within the same visual. Distinct from drillthrough (jump to another page).

Drillthrough

A feature that carries a selected value (e.g., a product) to another report page for detail, with a back button. Distinct from drilldown (descend a hierarchy in the same visual).

Dropdown

A control to pick one item from a list; bind it to a choice column or table values to prevent input variation.

DRP (Disaster Recovery Plan)

A Disaster Recovery Plan: the concrete procedures for restoring IT systems within a target time after an emergency such as an earthquake or a cyberattack takes systems down. It sits under the broader BCP, which covers overall business continuity, and specifies how to restore from backups and meet RTO/RPO targets.

DSCP and PHB

DSCP (Differentiated Services Code Point) marks a packet's priority class in a field of the IP header, with values such as EF (Expedited Forwarding, for top-priority traffic like voice), AF (Assured Forwarding, subdivided by class and drop precedence), and CS (backward-compatible with the old IP precedence field). Each network device independently applies a per-hop behavior (PHB) matching the DSCP value at every hop, delivering consistent QoS from source to destination.

DSSE-KMS (dual-layer server-side encryption)

A server-side encryption mode that applies two independent encryption layers to an S3 object using KMS keys. It targets regulated workloads with high-assurance requirements (mandated double encryption) that a single layer can't satisfy, such as FIPS 140-2 or ITAR contexts, at a higher processing cost than ordinary SSE-KMS.

DTP (Dynamic Trunking Protocol)

A Cisco proprietary protocol that auto-negotiates trunking between adjacent switch ports. While convenient, an unintentionally negotiated trunk can be a foothold for VLAN hopping, so best practice is to disable DTP (nonegotiate) on ports that do not need it.

Dual System

A configuration with two identical computer systems running the same processing in parallel, cross-checking results continuously to ensure reliability. If one system fails, it is disconnected and the other continues processing alone.

Dual-stack VPC (IPv4/IPv6)

A configuration where a single VPC/subnet runs both IPv4 and IPv6 addressing together. IPv6 addresses are all globally routable with no exhaustion concern, but to allow only outbound traffic and block inbound, an egress-only internet gateway is used.

Duplex System

A configuration with an active (primary) system handling processing and a standby (secondary) system on hold. Standby modes are classified as hot, warm, or cold standby, trading off failover speed against cost. Unlike a dual system, which runs the same processing on two systems in parallel and cross-checks the results, a duplex system has only one system doing the live processing while the other waits.

Duplicate query (Power Query)

A Power Query feature that copies all of an existing query's steps to create an independent new query. After duplication it is detached from the source—editing one does not affect the other. Unlike a reference query, it is a fully independent copy that evolves separately from then on.

Duplication detection

A safeguard that blocks/suppresses suggestions matching public code to reduce licensing concerns; an aid—post-adoption license-check responsibility remains.

Durability and availability (nines)

Durability = probability of not losing data (S3 is 99.999999999%—eleven nines—virtually no loss). Availability = probability the service is reachable (e.g., 99.99% ≈ 52 minutes/year of downtime). They are distinct; SLAs are usually stated as availability.

Durable Functions

An extension to write stateful workflows in functions; an orchestrator function manages the flow (chaining, fan-out/in, human approval).

DX (Digital Transformation)

Transforming products, services, business models, organizations, and corporate culture through the use of data and digital technology to establish a competitive advantage — a different goal from simple digitization.

Dynamic data masking

Masks sensitive data in query results without changing the stored data. Users with the UNMASK permission see the real values.

Dynamic data masking (Fabric)

Shows data masked (e.g., partial email) only to unauthorized users; the underlying data is unchanged, masked at display.

Dynamic format strings

Changes a measure’s display format (currency, percent) dynamically via DAX by condition; often used with calculation groups.

Dynamic group membership rules

Rules that auto-add/remove devices/users to a group based on attributes (OS, ownership), versus a manually fixed assigned group.

Dynamic management views (DMVs)

Views that expose live internal server/database state (waits, blocking, index usage, etc.) queryable via SQL.

Dynamic model routing

Dynamically switching which model handles each request based on input classification or settings—routing simple queries to small models and hard ones to large models to balance cost and quality. Routing rules can be updated without redeploy via AppConfig, etc.

Dynamic programming

An algorithm design technique that divides a problem into subproblems and stores (memoizes) each subproblem's result for reuse, avoiding redundant recomputation of the same subproblem and reducing overall computational cost. It is especially effective for problems with heavy subproblem overlap, such as computing Fibonacci numbers, shortest-path problems, and the knapsack problem.

Dynamic routing mode (global/regional)

A VPC setting that determines how far BGP routes learned by Cloud Router propagate: regional stays within one region; global propagates to all regions. Use global to span multiple regions.

Dynamic Routing vs. Static Routing

Dynamic routing uses a routing protocol to automatically exchange and learn route information, updating the routing table as topology changes occur. Static routing relies on administrator-configured fixed routes that persist until manually changed. Dynamic routing reduces operational burden in large networks, while static routing offers predictability and no protocol overhead in small or stub networks.

Dynamic Voltage and Frequency Scaling (DVFS)

A power-saving technique that dynamically varies a processor's clock frequency and supply voltage according to workload, delivering the performance needed while curbing power consumption. Since power draw is roughly proportional to the square of voltage and to frequency, lowering both during low-load periods yields a large benefit, making DVFS an important technique in the power design of battery-operated embedded devices.

Dynamic Workload Scheduler

A service that schedules acquisition of scarce accelerator capacity such as GPUs/TPUs, securing high-demand resources in a planned way.

DynamoDB Accelerator (DAX)

An in-memory cache purpose-built for DynamoDB that speeds reads to microseconds and offloads read traffic, with minimal app code changes.

DynamoDB capacity and TTL

Capacity is on-demand (auto, pay-per-request) or provisioned (RCU/WCU, Auto Scaling). TTL auto-deletes expired items, PartiQL gives SQL-like access, and throttling is retried with exponential backoff.

DynamoDB capacity behavior (hot partitions/adaptive capacity)

Skewed access to certain keys causes hot partitions and throttling. Adaptive capacity automatically absorbs skew, and burst capacity tolerates short spikes. The design basic is a high-cardinality partition key to spread load.

DynamoDB capacity modes (on-demand / provisioned + Auto Scaling)

On-demand requires no capacity management and auto-follows demand (unpredictable load, pay-per-use); provisioned sets RCUs/WCUs with Auto Scaling tracking a utilization target (cheaper for predictable load; reserved capacity adds discounts). Choose by load profile.

DynamoDB design features (GSI/DAX/Global Tables)

Global secondary indexes (GSI) enable alternate-key queries, DAX adds microsecond caching, Global Tables provide multi-Region active replication, and Streams emit change events. Capacity is on-demand or provisioned.

DynamoDB TTL (auto-expiry)

Sets an expiry-timestamp attribute on items so expired items are deleted automatically (without consuming write capacity). Auto-cleans transient data like sessions/logs to cut storage cost; deletions can also flow to DynamoDB Streams.

DynamoDB write control (conditional/transactions)

Conditional writes prevent conflicts and optimistic locking (version number) detects overwrites. Multi-item consistency uses transactions (TransactWriteItems), and reads use Query (by key) vs Scan (full).

e-business and EC (electronic commerce)

e-business refers to business activities broadly conducted over the internet. At its core is EC (electronic commerce), the buying and selling of goods and services over a network, classified into forms such as business-to-business (BtoB), business-to-consumer (BtoC), and consumer-to-consumer (CtoC).

EAI (enterprise application integration)

A mechanism and set of products that link heterogeneous applications and systems scattered within an enterprise to integrate their data and processes. A typical configuration connects many systems to a central hub in a hub-and-spoke arrangement, absorbing differences with adapters and avoiding the complexity of individual point-to-point connections. The architect uses EAI to interconnect existing systems without major rebuilding, eliminating duplicate data entry and inconsistencies.

Earliest Deadline First (EDF)

A scheduling policy that dynamically assigns the highest priority to whichever task has the nearest deadline. Unlike the fixed-priority rate-monotonic policy, priorities change at run time under this dynamic-priority scheme. On a single processor it can theoretically achieve schedulability up to 100% utilization, but the trade-off is greater implementation complexity and unpredictable behavior under overload.

Early termination policy (Bandit/median)

A sweep setting that cancels unpromising trials to save cost. Options include Bandit (slack factor), median stopping, and truncation selection.

Earned value (EV)

The value of work actually completed, measured in terms of the approved budget for that work. It represents "how much value the completed work is worth" and, combined with PV and AC, is the central figure used to compute every other earned value metric such as SV, CV, SPI, and CPI.

eBGP (external BGP)

The form of BGP in which routers in different autonomous systems (AS) peer directly with each other. Its administrative distance defaults to 20, taking priority over IGP-derived routes. Best-path selection compares several path attributes in priority order, typically narrowing by weight, then local preference, then locally originated routes, then shortest AS_PATH, then origin type, then MED, then preferring an eBGP-learned path, then lowest IGP metric.

EBS encryption

A feature that encrypts EBS volumes at rest with an AWS KMS key. Snapshots and AMIs created from an encrypted volume inherit the encryption, and default encryption can be enforced account/Region-wide. An existing unencrypted volume cannot be converted directly—it must be copied via a snapshot.

EBS snapshot sharing

A feature that shares an EBS snapshot with another AWS account. Sharing an encrypted snapshot requires not only the snapshot's own share setting but also granting the target account usage permission in the key policy of the customer-managed key (CMK) used to encrypt it.

EBS snapshots

Incrementally backs up an EBS volume to S3 (only changes after the first). Snapshots can be copied across AZ/Region, turned into AMIs, and shared. Fast Snapshot Restore (FSR) removes first-touch latency; Data Lifecycle Manager automates schedules.

EBS volume types (gp3/io2/st1/sc1)

Choose by workload: gp3 general-purpose SSD (IOPS/throughput set independently), io2/io2 Block Express for durable high-IOPS, st1 throughput-optimized HDD, and sc1 cold HDD.

EC2 Fleet

A feature that launches a set of instances meeting a target capacity in one request, spanning multiple instance types, purchase options (On-Demand/Reserved/Spot), and AZs. Unlike Spot Fleet, it can mix On-Demand and Spot in the same request. The request type is instant (synchronous, one-time), request (asynchronous, one-time), or maintain (keeps target capacity and auto-replenishes interruptions); the default is maintain.

EC2 hibernation

Saves RAM contents to EBS on stop and restores state on start, resuming work without rebooting the OS/apps—used to shorten startup for workloads with long initialization.

EC2 instance families

EC2 types grouped by purpose: general purpose (T/M—balanced; T bursts), compute optimized (C—high CPU), memory optimized (R/X—large memory), storage optimized (I/D—fast local), and accelerated (P/G—GPU). Choose to fit the workload.

EC2 status checks and auto recovery

System status check = AWS-side infrastructure issues (host/network); instance status check = internal causes (OS/config); there is also an attached-EBS status check. A CloudWatch alarm’s EC2 action (recover/reboot/stop/terminate) configures auto recovery.

ECMP (equal-cost multi-path)

A generic routing technique that spreads traffic evenly across multiple paths of equal cost/metric. It's a broadly used networking concept, not tied to any one vendor; a representative application is distributing traffic across multiple VPN tunnels attached to an AWS Transit Gateway. When a workload needs to exceed a single tunnel's bandwidth ceiling (about 1.25 Gbps), Transit Gateway lets you bundle multiple tunnels and use ECMP to raise aggregate throughput.

Economies of scale

The idea that AWS aggregates many customers’ demand to lower unit costs, passing savings back as price cuts. Alongside pay-as-you-go, no upfront investment, and easy global reach, it’s a core cloud value proposition.

ECS task execution role

The IAM role the ECS agent itself uses to launch containers—pulling images from ECR, shipping logs to CloudWatch Logs, and fetching secrets from Secrets Manager/SSM Parameter Store for environment variables. It is distinct from the task role and is never exposed to the application code.

ECS task role

The IAM role that the application code running inside the container assumes to call AWS APIs such as S3 or DynamoDB. It's the target for least-privilege scoping of the app's own permissions, specified via a task definition's taskRoleArn.

Edge computing

Processing near users/data (the edge) to cut latency. On AWS via CloudFront/Lambda@Edge/CloudFront Functions (delivery edge), Local Zones and Wavelength (low-latency zones), and Outposts (on-premises).

Edge extensions (Local Zones / Outposts / Wavelength)

Extensions bringing AWS closer to users: Local Zones place compute/storage in metros, Outposts put AWS racks on-prem, and Wavelength sits inside 5G networks for ultra-low latency.

Edge location

Sites that cache/deliver content near users (Amazon CloudFront) for low-latency delivery.

EDI (Electronic Data Interchange)

A mechanism for electronically exchanging business transaction data, such as purchase orders and invoices, between computers in a predetermined format, speeding up processing and reducing manual work compared with paper documents.

eDiscovery

Searches, preserves (holds), collects, and exports relevant content for litigation or investigations.

Edit Mode

Proposes and applies multi-file changes from natural-language instructions; you indicate the scope.

EDR (Endpoint Detection and Response)

A mechanism that continuously monitors and records behavior on endpoints such as PCs and servers, detecting suspicious post-intrusion activity (process launches, network connections, file changes) and enabling isolation or investigation. Whereas antivirus is an entry-point control that detects known patterns, EDR assumes intrusion will happen and provides after-the-fact response and visibility.

EDR block mode

A feature that lets Defender for Endpoint's EDR block and remediate malicious artifacts it detects even on devices where a third-party antivirus runs in passive mode. It acts as a safety net so EDR detection capability isn't wasted in environments primarily using another vendor's AV.

EEM (Embedded Event Manager)

A Cisco IOS mechanism that detects an event occurring on the device and automatically runs a response to it. Inside an applet, an administrator defines an event (a trigger such as a matching syslog message pattern, a timer, or a CLI command) paired with an action to run when it fires (such as another CLI command or sending a notification), automating troubleshooting or configuration changes on the device itself with no external tooling required.

Effective access time and locality of reference

Effective access time is the hit-rate-weighted average access time across a memory hierarchy (cache plus main memory), computed as hit rate times cache time plus miss rate times main-memory time—a common calculation question. Locality of reference (temporal and spatial) is why caching works: recently accessed data or nearby addresses tend to be accessed again soon.

Effort (person-months, person-days)

A unit for estimating the amount of work needed to complete a task, expressed by multiplying the number of people by the duration. One person's work over one month is one person-month, forming the basis for estimating development scale and cost. Note that adding more people does not necessarily shorten the schedule proportionally.

EFS modes (performance/throughput/storage class)

EFS configuration axes: performance mode (General Purpose for low latency / Max I/O for high parallelism); throughput mode (Bursting / Elastic—auto-scales to demand / Provisioned); storage classes Standard and Infrequent Access (IA), with lifecycle management to auto-tier and cut cost.

EIGRP (Enhanced Interior Gateway Routing Protocol)

An advanced distance-vector protocol that uses bandwidth and delay as its primary metric, relying on the DUAL (Diffusing Update Algorithm) algorithm for loop-free path computation and fast convergence. By default it installs only the lowest-cost route, but configuring a variance multiplier lets it also load-balance across qualifying unequal-cost paths. Its administrative distance defaults to 90, taking priority over OSPF's 110.

Elastic IP and placement groups

An Elastic IP is a remappable static public IP. Placement groups control physical instance placement: cluster (low latency), spread (fault isolation), or partition (large distributed).

Elastic Jobs

Automation for Azure SQL Database. Uses a job agent and job DB to run T-SQL in parallel across DBs via target groups.

Elastic Load Balancing (ELB)

Distributes traffic to healthy targets across instances/AZs; a staple for high availability.

Elastic Network Interface (ENI)

A virtual network card holding private IPs, Elastic IPs, security groups, and a MAC; it can be detached/attached between instances (failover). Multiple ENIs enable multi-homing or separating management/data traffic.

Elastic pool

Shares compute resources (eDTUs/vCores) across multiple Azure SQL Databases, optimizing cost for many DBs with offset usage peaks.

Elastic table (Dataverse)

A NoSQL-style Dataverse table built on Azure Cosmos DB, suited to large data volumes, variable schema, and high-throughput writes, scaling horizontally via a partition key. It has more constraints than standard tables around row-level consistency guarantees and some relationship features, so it fits specific use cases like IoT logs.

ElastiCache (Redis / Memcached)

In-memory caching. Redis OSS (and Valkey, the recommended engine since 2024) offers replication, persistence, Pub/Sub, and sorted sets; Memcached is simple and multithreaded for horizontal scale—chosen by use.

Elasticity

Automatically scaling capacity with load (autoscaling); scalability made automatic.

Elliptic Curve Cryptography (ECC)

Public-key cryptography whose security rests on the hardness of the discrete logarithm problem over elliptic curves. It achieves strength equivalent to RSA with a shorter key length, so it is used where processing load or key size is constrained; it appears as ECDSA for signatures and ECDHE for key exchange.

ELT (extract, load, transform)

A data-integration pattern that loads raw extracted data into the destination (warehouse/lake) first, then transforms it there using the destination's own compute. It grew popular as cloud warehouses gained parallel processing power, and keeping the raw data around adds flexibility.

Email Log Search

A tool to track a specific message delivery status (delivered, rejected, marked spam, delayed); pair with header analysis (route, SPF/DKIM/DMARC results) for root cause. Cross-data investigation and bulk action use the investigation tool.

Embedded audit module method

A CAAT technique in which audit-specific functionality (such as extracting and logging exception transactions that meet certain conditions) is built directly into the production program, continuously collecting audit evidence while the system operates. It enables real-time, ongoing monitoring, but because it requires modifying the production program, the cost and control of implementation and maintenance become key considerations.

Embedded SQL

A style of writing SQL statements directly inside host-language source code, such as C or COBOL; a precompiler translates them into host-language function calls at build time. Embedded SQL can include both static SQL (fixed at compile time) and dynamic SQL (assembled as a string at run time); the approach it contrasts with is the call-level interface (CLI/ODBC), which passes SQL through a library at run time.

Embedded system

A computer system built into a product such as an appliance, automobile, or industrial machine and specialized to perform a specific function. Unlike general-purpose computers, it must often meet real-time and high-reliability requirements within constraints of limited memory, processing power, and power consumption. Centered on a microcontroller, it controls the device in coordination with sensors and actuators.

Embedding model selection

Choosing the embedding model that drives RAG retrieval accuracy—by dimensionality (accuracy vs storage/cost trade-off), domain fit, languages, and latency. Embed queries and documents with the same model; changing it requires re-embedding everything.

Embeddings

Numeric vector representations of text (etc.) enabling comparison of semantic closeness; used in search and RAG.

Encapsulation and Decapsulation

Encapsulation is the process of successively adding lower-layer headers (and trailers) to upper-layer data to form a PDU, while decapsulation is the reverse process at the receiver, stripping headers layer by layer before passing data upward. This mechanism lets each OSI layer operate independently, since lower layers need not interpret the payload's content. A typical example is an IP packet carried inside an Ethernet frame, itself carrying a TCP segment.

Encrypted secrets and variables (secrets / vars)

Store sensitive values as secrets (secrets.<name>) and non-sensitive config as variables (vars.<name>); scoped at org/repo/environment, with the narrower scope winning (environment > repo > org). Managed via REST API (writes are public-key encrypted).

Encryption

Transforming data with a key so only authorized parties can decrypt; symmetric/asymmetric, at rest/in transit.

Encryption at rest

Encrypting data while it sits on disk or object storage. Most managed cloud storage (block/file/object/DB) offers built-in encryption integrated with the platform's key management (e.g., a KMS). A baseline defense protecting the data itself against theft or unauthorized access.

Encryption in transit

Encrypting data while it moves across the network, typically protected with TLS. Only by pairing it with encryption at rest do you cover a piece of data's whole lifecycle (stored and moving)—satisfying both is a baseline security requirement.

Encryption keys (GMEK / CMEK / CSEK)

GMEK = Google-managed default keys; CMEK = customer-managed keys via Cloud KMS (control rotation/disabling); CSEK = customer-supplied keys. Data is encrypted at rest and in transit by default.

Encryption over ExpressRoute

Ways to encrypt traffic over the private ExpressRoute circuit: MACsec on the link itself, or an IPsec VPN layered over ExpressRoute.

End User Computing (WorkSpaces / AppStream 2.0)

Amazon WorkSpaces is managed virtual desktops (DaaS); Amazon AppStream 2.0 streams applications—delivering desktops/apps securely without managing endpoints.

Endorsement (promoted/certified)

A governance feature that marks trustworthy items as Promoted or Certified so users can identify high-quality data.

Endpoint (device) management

Basic management applies minimal protection (e.g., screen lock); advanced management adds device approval, finer policy, and remote wipe. Company-owned gets strong management; personal (BYOD) uses account wipe to protect only work data.

Endpoint Analytics

An Intune analytics feature that visualizes endpoint performance/reliability and user experience through metrics like device health scores (startup, battery, driver health), startup performance (boot-time breakdown), and application reliability (app crash/unresponsive frequency). It specializes in visualization and does not itself automatically fix detected issues.

Endpoint auto-scaling

Scales the instance count of a real-time inference endpoint by load to balance cost and latency; serverless inference can scale to zero.

Endpoint device

A general term for devices connected at the edge of a network that a user directly operates or that exchange data, including computers, smartphones, IP phones, printers, IoT devices, and servers.

Endpoint DLP

DLP that controls actions on Windows/macOS devices—copy (USB), print, upload to cloud, clipboard. Distinct from cloud-workload DLP policies.

Endpoint Privilege Management (EPM)

An Intune Suite add-on that temporarily elevates standard users for specific actions only, without standing admin (least privilege).

Enhanced networking (ENA / EFA)

High-throughput, low-latency networking. ENA (Elastic Network Adapter) reaches ~100 Gbps; EFA (Elastic Fabric Adapter) provides OS-bypass ultra-low latency for tightly coupled HPC/ML workloads.

Enrollment restrictions (Intune)

A policy mechanism restricting which device platforms (iOS/Android/Windows, etc.), OS versions, or personally owned (BYOD) devices may enroll. A default restriction and custom restrictions for specific groups are applied by priority order, letting admins block enrollment from unsupported old OS versions or disallowed platforms.

Enrollment Status Page (ESP)

A page that shows configuration progress and any blocking apps/policies during deployment (e.g., Autopilot).

Ensemble learning (bagging/boosting)

Combining multiple models to improve accuracy: bagging (parallel, variance reduction, random forest) and boosting (sequential, bias reduction, XGBoost).

Enterprise access model

A design principle separating control/management/data planes to isolate privilege in layers (successor to the old tier model). Combined with PIM and PAW to secure privileged access.

Enterprise architecture (EA)

A methodology that visualizes and optimizes an organization's business processes and IT systems in a unified way across four architectures — business, data, application, and technology — aiming for overall optimization and consistency between operations and systems.

Enterprise Managed Users (EMU)

Dedicated users a company manages centrally via its identity provider; separate from personal accounts.

Enterprise teams

A higher-level team that manages membership, roles, and policy (governance) across multiple organizations within an enterprise; define a team once and assign it to many organizations. Nesting and parent-permission inheritance are features of organization-level teams, not enterprise teams.

Entity

In data modeling, an abstracted unit representing an object to be managed in business (such as a person, item, or event). Represented as a rectangle in E-R diagrams, an entity is identified by a primary key among a set of attributes, and corresponds to a table in a relational database.

Entity (Copilot Studio)

A type of information to extract from conversation (date, number, city, email); pulls values from utterances to pass to flows or answers.

Entity graph

Links users/assets/relationships (entities and context) in Google SecOps to give detection rules context and raise accuracy; enrich events with entities to speed investigation.

Entity recognition (NER) and PII detection

Named entity recognition (NER) extracts people, places, organizations, and PII detection finds and masks personally identifiable information.

Entity-relationship diagram

A conceptual modeling technique used in database design to diagram entities and the relationships between them. It explicitly shows the cardinality between entities (one-to-one, one-to-many, many-to-many) and is used as a precursor to logical database design and normalization.

Entra ID Governance

Ensures the right people have the right access to the right resources for the right time. Includes entitlement management (access packages), access reviews, Privileged Identity Management (PIM), and lifecycle workflows.

Entra identity types

Identity types managed by Microsoft Entra: users (member/guest), groups, devices, and workload identities (service principals/managed identities) representing apps and services.

Entra users and groups

Manage member/guest users and assigned/dynamic groups. Assigned groups add members manually; dynamic groups auto-determine membership by attribute rules (no manual add). Bulk user create/edit is done separately via bulk operations (CSV import, etc.); guests are added by invitation.

env: (environment variables)

A key defining environment variables at workflow/job/step levels; narrower scopes take precedence.

Envelope encryption and data keys

Encrypts data with a data key, then encrypts that data key with a KMS master key for storage. GenerateDataKey returns plaintext/ciphertext data keys; the plaintext is discarded after use.

Environment

A reproducibility unit that pins training/inference dependencies (Python packages, Docker images, conda). You can use curated or custom environments.

Environment (Power Platform)

An isolated container for apps, flows, and Dataverse data—used to separate by department or Dev/Test/Prod; each has its own security boundary.

Environment and protection rules

A unit representing a deploy target; supports required-reviewer approval, a wait timer, deployable-branch restrictions, and environment-scoped secrets/variables—gating production deploys.

Environment types

Environment types by purpose: Default (auto-created per tenant), Production, Sandbox (test/resettable), Developer (personal), Trial (time-limited).

Environment variables (Power Platform)

Settings whose values differ per environment; shipped in a solution so endpoints/URLs change dev→prod without editing apps.

Environments and approvals/gates (Azure Pipelines)

Environments representing deploy targets (Dev/Test/Staging/Prod) and checks that control deployment to them. Combine approvals (human sign-off), gates (automated checks like monitoring queries), branch control, business hours, and required templates to protect production resources.

Ephemeral port

A temporary high-numbered port (typically 1024–65535) a client uses for the return leg of a connection. Stateless firewall rules (e.g., network ACLs) must explicitly allow this range for return traffic to work—an easily overlooked source of misconfiguration.

EPSS (Exploit Prediction Scoring System)

A score estimating the probability a vulnerability is actually exploited; combined with severity (CVSS) to prioritize "severe and likely-exploited" issues.

Equivalence partitioning and boundary value analysis

Core black-box test-design techniques. Equivalence partitioning groups inputs into classes expected to behave alike and samples a representative value from each; boundary value analysis targets values at and adjacent to class boundaries, where defects concentrate. Combining both reduces test-case count while raising defect-detection rates.

ERP (Enterprise Resource Planning)

A concept and packaged software for integrally managing core operations such as accounting, HR, production, and sales, so that management resources — people, goods, money, and information — are optimally allocated across the whole company.

Error budget

The allowable amount of failure (1 − SLO) derived from an SLO. Teams ship aggressive changes while budget remains and prioritize stabilization once it's exhausted—a shared language for release decisions. Blameless postmortems examine what consumed the budget and feed lessons back into prevention.

Error Control

Error control refers to mechanisms for detecting and correcting bit errors introduced during transmission, broadly divided into error detection (parity checks, CRC—cyclic redundancy check), error correction via forward error correction such as Hamming codes, and ARQ schemes that request retransmission upon detecting an error. Ethernet frames perform error detection only, via the FCS (CRC) field, leaving error correction and retransmission to upper layers such as TCP.

Error log

A log recording a web server startup/configuration errors or problems during request handling. Apache writes it to error_log and it is usually the first clue when troubleshooting.

Error rate

The proportion of failed requests out of total requests. It's one of the most common SLIs, used as a CloudWatch metric and alarm threshold; a sudden spike is often monitored as a signal of a deployment-caused failure or throttling.

Error Reporting

Automatically aggregates and groups application errors, surfacing frequency and new occurrences with notifications; easier to prioritize high-impact errors than eyeballing raw logs.

ESB (enterprise service bus)

In service-oriented architecture (SOA), a platform that mediates inter-service integration over a "bus" through message routing, protocol and data-format transformation, and mediation. Because each service communicates loosely coupled via the bus, the number of connection combinations is reduced and the impact of adding or changing services is localized. The architect uses an ESB to integrate many services in a standardized, loosely coupled way.

Escalation (functional and hierarchical)

The mechanism for passing a case that first-line cannot resolve to a higher level. Functional escalation hands it to a team with deeper technical expertise, while hierarchical escalation raises it to managers for authority, judgment, or business decisions. Choosing the right type balances faster resolution with proper control.

ESG and the SDGs

ESG is a management and investment perspective emphasizing three factors, Environment, Social, and Governance, used by investors to evaluate the non-financial sustainability of a company. The SDGs (Sustainable Development Goals) are a set of 17 goals adopted by the United Nations to be achieved by 2030; companies are expected to incorporate contributions to the SDGs into their business and management strategy, going beyond CSR to create new business opportunities and enhance long-term corporate value.

ESP (EFI System Partition)

A FAT-formatted partition holding the boot loader for UEFI boot, mounted at /boot/efi.

Estimate at completion (EAC)

An EVM metric that forecasts the total cost at project completion. Assuming current cost efficiency continues, EAC = BAC (budget at completion) ÷ CPI. If CPI is below 1 (a cost-overrun trend), EAC exceeds BAC, signaling an expected budget overrun.

Estimate to complete (ETC)

The estimated cost of the remaining work needed to complete the project from the current point forward. When current performance is assumed to continue, it is calculated as ETC = (BAC minus EV) divided by CPI, and it is a component of EAC used to revise funding plans.

EtherChannel

Cisco's implementation name for bundling multiple physical switch ports into one logical link, using either LACP (open standard) or PAgP (Cisco proprietary) to negotiate the bundle. STP sees the bundle as a single logical link, so it gains bandwidth and redundancy without STP blocking individual member links.

Ethernet

Ethernet is a LAN data-link/physical-layer technology standardized as IEEE 802.3, using MAC addressing and Ethernet frames for data transfer. It originally used shared-bus CSMA/CD access, but modern deployments use switched, full-duplex point-to-point links, with speeds ranging from 10 Mbps to 400 Gbps across various standards. Exams often test frame format details and the naming convention of speed standards (e.g., 1000BASE-T).

ETL (extract, transform, load)

A data-integration pattern that extracts data from a source and transforms it (cleansing, reshaping, aggregating) before loading it into the destination. It needs separate transform compute (a server or managed service), but only clean, shaped data ever lands in the destination.

Evaluation of access controls

In a systems audit, the auditor's assessment of the design and operation of access controls, including authentication, authorization, the principle of least privilege, and management of privileged (administrator) IDs. The auditor verifies whether granted permissions are proportionate to job duties and whether periodic access reviews are performed.

Evaluation reporting / model comparison

Evaluating multiple models or prompt configurations on common metrics/datasets and comparing them via visualizations and automated reports. Bedrock Model Evaluation (automatic metrics, human, LLM-as-a-judge) lines up accuracy/cost/latency to inform selection and improvement decisions.

Event data and entity data

Event data records "when what happened" (behavior; Cloud Audit Logs), entity data is context for "who/which asset" (AD organizational context); reconcile multiple identifiers via aliasing fields before enriching.

Event flag

A synchronization object made up of multiple bits, where each bit represents the occurrence of a specific event. A task can wait until a particular bit pattern is satisfied (a single event, or an AND/OR combination of multiple events), offering more flexibility than a semaphore when synchronization depends on a combination of asynchronous events.

Event management

The process that detects changes of state (events) in services or configuration items reported by monitoring tools, classifies them as informational, warning, or exception, and routes them to appropriate action. Through threshold monitoring it catches early signs of incidents and serves as the trigger for automated responses or notifications.

Event replay

An operation that resends events stored in an archive back onto the event bus for a specified time range. Replayed events are processed by rules just like new ones, so it is used to redo target processing skipped during an outage or to backtest a newly created rule.

Event source mapping and destinations

Event source mapping polls SQS/Kinesis/DynamoDB Streams to invoke Lambda. Tune batch size/window, and route failures to destinations or a DLQ.

Event sourcing

A design pattern that stores the sequence of change events—not the current state itself—as the source of truth. State at any point can be rebuilt by replaying events from the start, and because the full history of changes is preserved, it offers strong auditability. Pairs naturally with streaming and event-driven platforms.

Event Threat Detection

A Security Command Center built-in that detects known threats (suspicious logins/privilege escalation) from Cloud Audit Logs (Admin Activity/Data Access), etc.; supplement cloud-specific IOCs with custom detectors.

Event Viewer

The tool built into Windows for viewing System, Security, and Application event logs. Used to look for traces of abnormal behavior, such as a string of failed logins or a service crashing unexpectedly.

Event-driven AI pipelines

A design where Event Grid/Service Bus/Event Hubs trigger asynchronous AI processing (ingest → embed → index → infer) via events and messages.

Eventarc

A service that routes events from diverse sources (Pub/Sub, Cloud Storage changes) uniformly to Cloud Run/Cloud Functions.

EventBridge archive

A feature that saves events passing through an event bus—either all of them or only those matching a filter—for later use. It is the storage prerequisite for replaying past events during disaster recovery or debugging, with a retention period set to unlimited or a fixed number of days.

EventBridge cross-account integration

Forwards events from one account’s event bus to another’s, enabling cross-organization event-driven flows; a resource-based policy authorizes the source. Used for centralized auditing and aggregating security events.

EventBridge Pipes

Point-to-point pipes that connect a source (SQS, Kinesis, DynamoDB Streams, etc.) directly to a target. Optional filtering, enrichment (e.g., via Lambda), and transformation steps can sit in between, often removing the need to write a separate Lambda just for integration glue.

EventBridge rule

A rule that routes events matching an event pattern (match conditions on source/content) or a schedule to one or more targets (Lambda, SQS, Step Functions, etc.). A single rule can have multiple targets, and retry behavior or a dead-letter queue for failed deliveries can be configured.

EventBridge Scheduler

An EventBridge capability that runs cron, rate, or one-time schedules at scale with timezone support. It can manage millions of individual schedules and is positioned as the successor to scheduling via legacy CloudWatch Events rules.

Eventhouse (KQL database)

A Real-Time Intelligence store for large event/time-series data; contains KQL databases queried fast with KQL.

Eventstream

A no-code streaming pipeline that ingests events (IoT, logs, queues), transforms them, and routes to Eventhouse or lakehouse.

Eventual consistency

A consistency model where a read right after a write may return a stale value, but all replicas eventually converge over time. It's often the default behavior of distributed data stores that prioritize availability and low latency, and using it for reads that don't need strong consistency buys throughput.

EVM (earned value management)

A technique for managing project progress and cost using value-based metrics. From planned value (PV), earned value (EV), and actual cost (AC), it computes cost variance (CV) and schedule variance (SV) to quantify delays and cost overruns.

Exchange admin center

The dedicated admin center for configuring Exchange Online mail objects. It manages mailboxes and distribution lists (groups that broadcast to multiple recipients).

Exchange Online

A cloud service for email and calendar (hosted mailboxes); Outlook is the client that uses it.

Exclusive control (locking)

A mechanism that locks data to restrict simultaneous access by other processes, preventing the inconsistencies that can arise when multiple users or processes try to update the same data at the same time.

ExecuteMultiple (bulk request)

Batches many create/update operations into one request for performance (ExecuteMultipleRequest).

Execution pipeline stages

The stages at which a plug-in registers: pre-validation (outside transaction, first, input validation), pre-operation (inside, before DB write, adjust values), post-operation (inside, after DB write, related updates).

Execution plan

A diagram of how a query executes. Inspect scan vs seek, key lookups, and non-SARGable predicates to decide index or rewrite improvements.

Exit status ($? / exit)

A number indicating a command result: $? holds the last exit status (0 = success, non-zero = failure), and exit N sets a script own status. It underpins branching with && and ||.

Expected monetary value (EMV)

A quantitative risk analysis metric calculated by multiplying a risk financial impact by its probability of occurrence (EMV = probability x impact). Because it converts multiple risk scenarios into comparable monetary terms, it is the basis for judging which option is favorable in expected-value terms in techniques such as decision tree analysis.

Expected value

The sum of each possible value of a random variable multiplied by its probability of occurrence: E(X) = Σ(x_i × p_i). It represents the average outcome expected over many repeated trials, and is used widely — from comparing expected payoffs in decision-making to quality control and insurance premium calculation.

Experience (Fabric)

Role-specific feature sets (Data Engineering / Data Factory / Data Warehouse / Real-Time Intelligence / Power BI); all share the same OneLake.

Expiration policy

Auto-expires unused Microsoft 365 groups (teams) after a period to clean up. Distinct from a naming policy (which enforces naming).

EXPLAIN / EXPLAIN ANALYZE

Commands that visualize the plan the planner chose. EXPLAIN shows only the plan without actually running the query (estimates only). EXPLAIN ANALYZE actually executes the query and reports real row counts and timings alongside the estimates, so a gap between estimated and actual rows can diagnose issues like stale statistics.

Exploit

The specific means or code that actually leverages a vulnerability to cause an unintended effect, such as unauthorized access, privilege takeover, or a denial of service. Where a vulnerability is the weakness, an exploit is the means of actually attacking it.

Exponential backoff

A retry technique that exponentially lengthens the wait before each retry after throttling or an error. Adding jitter (random variation) mitigates the thundering-herd problem where many clients retry simultaneously and pile more load on. Many cloud SDKs implement this by default.

Expressions

Function expressions inside a flow that transform/compute data (format dates, concatenate strings, conditions), combined with dynamic content to build action inputs.

Expressions (${{ }})

Expressions evaluated inside ${{ }} for if: and value interpolation; mind static (parse-time) vs runtime evaluation and never leak secrets into expressions/logs.

ExpressRoute

A dedicated private connection that does not use the internet; high reliability, consistent low latency, high bandwidth.

ExpressRoute Direct

An ExpressRoute form that connects directly to Microsoft's edge routers over dedicated 10 Gbps or 100 Gbps port pairs, without going through a connectivity provider. Multiple ExpressRoute circuits can be carved out of one physical connection, suited to workloads needing very high bandwidth and low latency.

ExpressRoute FastPath

An option that, on supported SKUs, bypasses the virtual network gateway in the ExpressRoute data path for lower latency and higher throughput (normally the path traverses the gateway). Certain configurations (e.g., via UDRs or load balancers) are excluded from FastPath support.

ExpressRoute gateway

A virtual network gateway connecting an ExpressRoute circuit to a VNet; the SKU sets bandwidth and performance.

ExpressRoute peering (private/Microsoft)

ExpressRoute peering types: private peering reaches VNets; Microsoft peering reaches public Microsoft 365/PaaS over the private circuit. Always exchanged via BGP.

Extended Events

A lightweight event-collection framework. The successor to SQL Trace, it diagnoses deadlocks, long-running queries, etc. with low overhead.

External access (federation)

Lets users chat/call with external domains in Teams; they do not become members of your teams. Distinct from guest access (which makes a guest a member).

External Attack Surface Management (EASM)

Discovers internet-facing assets the organization is unaware of, from the outside in, surfacing the external attack surface. Distinct from Defender Vulnerability Management, which internally assesses known vulns on your assets.

External design and internal design

External design is the phase that defines the externally visible specification of a system, such as screens, reports, data items, and process flows as seen by users. Internal design is the phase that defines the developer-facing internal specification — the internal program structure, module decomposition, and data structures — needed to realize the external design. Detailing proceeds in the order external design → internal design → program design.

External user (B2B guest)

A user object registered as a guest in Microsoft Entra ID, retaining the partner organization's existing identity. Accepting an invitation creates a user object in the tenant (UserType=Guest), which can be targeted by Conditional Access and license assignment. It is the object created by the B2B collaboration feature, distinct from a role group (a permission-delegation unit).

Fabric ingestion and transformation (pipelines, Dataflows Gen2, Spark, medallion)

Ingestion: data pipeline (orchestrate/schedule/retry activities like Copy/notebook), Copy activity (fast bulk movement; incremental via watermark), Dataflows Gen2 (no-code Power Query shaping), shortcuts (reference), Eventstream (streaming). Transformation: Spark notebooks (PySpark/Spark SQL; large/ML), T-SQL (Warehouse; set-based), Dataflows Gen2 (no-code). Design with the medallion architecture: bronze (raw) → silver (cleanse/join) → gold (aggregate/business-ready), storing each layer as Delta.

Fabric monitoring and optimization (Monitoring hub, Capacity Metrics, V-Order, OPTIMIZE)

Monitoring: Monitoring hub (run history/status/duration for pipelines/notebooks/Spark), Capacity Metrics app (visualize CU consumption/throttling and find overload sources), Data Activator (auto-trigger notifications/actions on data conditions). Error handling: retry policies (transient) + failure paths. Optimization: V-Order (read-optimized layout), OPTIMIZE (compact small files—the go-to fix for the small-files problem; Z-Order for data skipping), VACUUM (remove old unreferenced files), partition design, Spark/capacity tuning.

Fabric security and governance (workspace roles, sensitivity labels, deployment pipelines)

Workspace roles: Admin > Member > Contributor > Viewer (least privilege). Data-level control via item permissions, row-level security (RLS), and column/object permissions. Governance: sensitivity labels (Microsoft Purview Information Protection for classification/encryption/watermarks) and Purview (auditing, lineage, data catalog). Releases: deployment pipelines (promote artifacts dev→test→prod with diff comparison) and Git integration (CI/CD). Tenant-wide feature availability is governed by admin-portal tenant settings.

Face

Specialized in detecting/analyzing faces in images (some features restricted for Responsible AI).

Facility management (UPS, seismic isolation and resistance)

The activity of optimally maintaining and managing the physical facilities of a data center or similar site — building, power, and air conditioning. A UPS (uninterruptible power supply) supplies power for a limited time during an outage, bridging until a backup generator takes over or a safe shutdown completes. Seismic isolation absorbs shaking between the building and the ground so tremors are less transmitted to the building, whereas seismic resistance makes the building itself strong enough to withstand shaking; the two differ in how the shaking is transmitted.

Fact table

The central table holding numeric measures (sales, quantity) and foreign keys to dimensions; first decide its grain (what one row represents).

Fact table and dimension table (in schema design)

The two table types making up a data-warehouse star schema. A fact table stores quantitative performance data such as sales volume or amount, while dimension tables store attribute data — "when," "who," "which product" — that provide the angles for analysis.

Factuality verification (anti-hallucination)

Verifying that generated content matches its evidence: grounding answers on sources via RAG, similarity/confidence scoring against sources, requiring citations, and verification by another model (LLM-as-a-judge)—reducing hallucinations (plausible-sounding errors).

fail-fast

A matrix-strategy setting; true (default) cancels the rest on one failure, false runs all combinations to completion. Use false to diagnose.

Fail-safe / fail-soft

Two design philosophies for handling failure. Fail-safe forces the system into a safe state even at the cost of halting its function (e.g., traffic lights turning all-red on failure, or a train's brakes automatically engaging via a dead-man mechanism on power loss), prioritizing safety over availability. Fail-soft instead isolates the failed part and continues operating in a degraded mode rather than halting the whole system, prioritizing continuity of service; it is commonly adopted in systems with redundant configurations.

Failover and failback

Failover is the mechanism or action of automatically switching processing to a standby system when the primary fails, preserving availability. Failback is returning processing to the original primary once it has recovered, from the standby that took over. The architect must design for data consistency and session takeover during failover, and for the brief interruption of switching back during failback.

Failover Cluster Instances (FCI)

Instance-level HA clustering an entire SQL Server instance across nodes on shared storage, auto-failing over on node failure.

Failover drill (DR exercise)

A periodic exercise that verifies HA/DR actually works when needed, measuring post-failover connectivity, consistency, and downtime against targets (RTO/RPO). Untested HA is unreliable.

Failover groups

A DR feature connecting a group of DBs via listeners and failing them over automatically without changing the connection string.

Failure pattern

The categories of failure anticipated in a system (physical failures, logical failures, breakdown of a single point of failure, etc.). HA design considers redundancy so service continues under any of these failure patterns.

Failure Recovery

The process of restoring a database to a consistent state after hardware or software failure, using transaction logs (before/after images) and backups. It consists of rollback, which undoes incomplete transactions, and roll-forward (redo), which reapplies completed transactions from a backup.

Failure triage (server stoppage, data loss, OS resource exhaustion, process state)

The standard first-pass triage: check via ps whether the postmaster and backend processes are alive, check disk usage with df/du, and check memory with free. A full disk is especially critical since it directly blocks WAL writes and can lead to a crash, so it is the top priority to clear. When data loss is suspected, check the PostgreSQL log for PGDATA/WAL corruption, and if the server cannot start, consider forcing recovery with pg_resetwal or restoring from the most recent backup.

False positive, false negative, true positive, and true negative

Four outcomes for grading an alert. A true positive (TP) is a real threat correctly flagged. A true negative (TN) is the correct absence of an alert when there is no threat. A false positive (FP) is an alert raised when there is no threat — too many of these cause analyst fatigue (alert fatigue). A false negative (FN) is a real threat that the alert missed entirely — the most dangerous kind of mistake.

Fast tracking

A schedule compression technique that shortens the schedule by performing activities in parallel that would normally be done sequentially. It adds no direct cost but can increase rework and risk, so the choice against crashing should weigh the trade-off of added cost versus added risk.

Fault tolerance

Designing so the service keeps running despite component failures—stronger than high availability (fast recovery): it continues without interruption. Achieved via redundant parallel paths (active/active), N+1, and spreading across AZs (auto-recovery, which involves a brief recovery, is more an HA technique).

Feasibility study

An analysis performed during the systemization-concept and planning stage that verifies in advance whether a project is achievable, from technical, cost, schedule, and organizational perspectives. When the study reveals factors that make realization difficult, the results feed into revising the plan, considering alternatives, or deciding to halt the project. In the Common Frame planning process, it is often conducted alongside drafting the systemization plan.

Feature engineering (binning/log transform/PCA)

Creating/transforming features to improve performance: binning continuous values, log-transforming skewed distributions, PCA for dimensionality reduction, and feature selection by correlation or importance.

Feature engineering and embeddings/RAG

Feature engineering shapes data for training/serving. For generative AI, turn unstructured data into embeddings and use retrieval-augmented generation (RAG) to fetch context for answers.

Feature flags

A mechanism that decouples deployment (placing code in prod) from feature enablement (release). Managed via Azure App Configuration Feature Manager, etc., enabling staged rollout, A/B testing, and instant disable (kill-switch) without redeploy.

Feature store

A system to define, compute, share, and reuse features. It retrieves the same features for training and inference to keep consistency (avoiding training/serving skew).

Features and labels

Features = inputs used for training; labels = the known answers in supervised learning.

Federated credentials (workload identity federation)

Authenticates an app by trusting tokens from an external IdP (e.g., GitHub Actions) without storing a client secret or certificate. Ideal for keyless authentication from CI/CD pipelines.

FHRP (First Hop Redundancy Protocol)

A collective term for protocols that make multiple physical routers appear as one virtual router, making a device's default gateway (its first hop) redundant. The open-standard VRRP and Cisco's proprietary HSRP and GLBP are common examples, all using a virtual IP address to automatically recover from a gateway failure without changing client configuration.

FHS (Filesystem Hierarchy Standard)

A convention defining the standard directory layout: /etc config, /var variable data (logs), /home users, /usr apps, /bin,/sbin core commands, /opt add-ons, /tmp temporary, /boot kernels, /dev devices, /proc,/sys virtual FS. Nearly universal across distributions.

Field parameters

Lets report users dynamically switch which measures or axes are shown; one visual offers multiple views.

Field-level encryption

Encrypts specific form fields (e.g., credit-card numbers) with a public key at the CloudFront edge and carries them confidentially to the origin; only the final processing point with the matching private key decrypts them.

FIFO (ordering / deduplication)

The FIFO variant of SQS/SNS: guarantees strict ordering per message group and removes duplicate sends within 5 minutes via a deduplication ID (or content-based dedup). Lower throughput than standard, but for workloads needing ordering and exactly-once.

Fifth normal form (5NF)

A normal form in which every join dependency is implied by the candidate keys, with all other join dependencies removed by lossless decomposition. It is treated as the practical endpoint of normalization, though higher forms such as 6NF exist in theory. A join dependency is the property that splitting a table and rejoining it reproduces the original content.

File paths (absolute and relative)

An absolute path is a notation giving the full route from the root (top level) to the target file. A relative path is a notation for the route starting from the current working location. The relative-path notation for the same file changes if the starting point changes.

File permission

Permissions an OS attaches to each file or folder, specifying who may read, write, or execute it. Windows expresses this with per-user/group NTFS ACLs; Linux with read/write/execute (rwx) bits for the owner, group, and others.

File storage

Storage exposed as a shared file system that many clients can access concurrently (EFS, FSx), organizing files in a directory hierarchy.

Fileless malware

Malware that leaves no executable file on disk and instead loads and runs code in the memory of legitimate system tools such as PowerShell or WMI. It evades signature-based (file hash/pattern) detection, so behavior-based monitoring is effective against it.

Filestore

A fully managed NFS file storage that mounts as a shared file system from Compute Engine VMs or GKE, providing low-latency shared storage.

Filesystem mounting (/etc/fstab)

Mounting attaches a filesystem at a point in the directory tree (a mount point); use mount/umount (umount fails while busy). Boot-time mounts are defined in /etc/fstab (device, point, type, options, dump, fsck order) and verified with mount -a. Removable media mount under /media.

Filesystem-level backup

A backup method that copies the entire data directory at the filesystem level, either as a simple copy while the server is stopped, or as a low-level backup performed while the server is running (via pg_backup_start()/pg_backup_stop() as of PostgreSQL 15, or pg_basebackup).

Filesystems and mkfs

Making a partition usable (formatting) means creating a filesystem, done with the mkfs family. ext4 is the general Linux standard (predecessor ext3), XFS excels at large/parallel workloads (RHEL default), VFAT interoperates with Windows, Btrfs is new-generation, and tmpfs lives in memory and vanishes on reboot.

FILLFACTOR

A storage parameter specifying how much free space to deliberately leave on table or index pages (default 100 = no free space). Lowering it on update-heavy tables makes HOT (Heap-Only Tuple) updates more likely, reducing index-update overhead.

FILTER / ALL functions

DAX functions that manipulate filters: FILTER narrows a table by condition; ALL removes filters (used for totals or ratio denominators).

Filter context and row context

The two DAX evaluation contexts: row context (the current row) and filter context (active filters); CALCULATE manipulates the filter context.

Filter function (Power Fx)

Extracts only records matching a condition; used to narrow galleries/lists—writing it to be delegable matters.

Filters (text-processing commands)

Single-purpose commands that transform stdin to stdout: view with cat/less (pager)/head/tail (-f follows), transform with tr/nl, join with paste/join, split with split, format with expand/unexpand/fmt/pr, dump binary with od. Combined via pipes.

find

Walks a path in real time to find matching files: filter with -name, -type (f/d), -size, -mtime (modified; -7 within 7 days), -user, and act in bulk with -exec command {} \;.

Fine-grained PAT

A Personal Access Token with fine-grained permissions, repo scope, and expiry. Issue with least privilege + expiry, revoke on leak; orgs can require approval/restrict it.

Fine-tuning

Further-training a foundation model on your labeled data to bake behavior/style/domain knowledge into its weights; heavier than RAG.

Fine-tuning and synthetic data operations

Optimize in order prompting → RAG → fine-tuning (cost/benefit). Fine-tuning hinges on high-quality training data; if insufficient, create synthetic data (managing quality/diversity/bias). Monitor fine-tuned models for overfitting/degradation and manage them dev-to-production via the MLOps lifecycle (evaluate → register → deploy → monitor).

Fine-tuning job

A job that further trains a foundation model on custom data to adapt it to a task, proceeding through data prep, base-model selection, training, and evaluation.

FinTech

A portmanteau of Finance and Technology, referring collectively to new financial services enabled by IT, such as smartphone payments, cryptocurrency, and robo-advisors.

Firestore

A scalable document NoSQL database for mobile and web app data.

Firewall

A mechanism that controls traffic according to allow/deny rules. On Linux it is implemented via iptables / firewalld, and in cloud environments it is offered as constructs like security groups.

Firewall policy (Intune)

An Endpoint security policy type that governs a device's inbound/outbound traffic via rules. It centrally deploys Windows Defender Firewall settings (per-profile on/off, rules, notification suppression) from Intune to allow/deny traffic for specific ports or apps. Whereas App Control restricts which apps may run, this restricts network communication.

Firewall policy and Firewall Manager

A firewall policy is a reusable config of rules, threat intelligence, etc.; Firewall Manager centrally applies policy across multiple firewalls/Secured Hubs.

Firewall rules (server/database)

Rules that control source IPs allowed to connect to Azure SQL. Server-level rules apply to the whole logical server; database-level rules apply to individual DBs.

Firewall types (packet filtering / application gateway)

Packet filtering is the most basic type, judging each packet's allow/deny by source/destination IP address and port number (up to the transport layer). An application gateway (proxy) type interprets the application-layer protocol and terminates/relays the session itself, allowing inspection of commands and data content, but it needs dedicated handling per protocol and has higher processing overhead. Stateful inspection, which dynamically tracks session state, is a separate method from these two.

Five forces analysis

A framework for analyzing an industry's competitive structure and profitability through five forces: rivalry among existing competitors, threat of new entrants, threat of substitutes, bargaining power of buyers, and bargaining power of suppliers. The stronger each force, the more industry profitability is squeezed; the framework informs business strategy formulation.

Fixed Allocation and Lease

Fixed (reserved) allocation binds a client identifier such as a MAC address to a specific IP address so the DHCP server always issues the same address — used for devices like servers that require a stable address. A lease is the validity period assigned to a dynamically allocated IP address; as expiry approaches the client sends a DHCPREQUEST (renewal) to extend it, and the address must be reacquired once the lease expires unrenewed.

Fixed cost and variable cost

Two categories obtained by breaking down total cost by its relationship to sales (or production volume). A fixed cost, such as rent or fixed salaries, is incurred at a constant amount regardless of sales, while a variable cost, such as raw material cost or piece-rate wages, rises and falls in proportion to sales. This split underlies break-even and CVP analysis.

Fixed IP

An IP address bound to a specific instance (server) that does not change. This contrasts with a floating IP, which can be carried over even when the underlying instance is replaced.

Fixed-price contract (FP)

A contract type in which a pre-agreed total amount is paid. It suits work where requirements are clearly fixed, and the risk of cost overrun falls on the vendor. Applying it to exploratory work with fluid requirements risks the vendor pricing in an excessive risk premium or cutting quality to compensate.

Flat L2 network (Docker)

Docker's default bridge network topology, where containers on the same host all attach to a single Layer 2 segment and can communicate directly without routing. It keeps container-to-container networking simple, though larger environments need segmentation.

Fleet

A way to manage many GKE clusters enterprise-wide with consistent policy/config, governing them centrally instead of per-cluster manual setup.

Flexible NetFlow

An implementation of NetFlow that lets an administrator freely combine key and non-key fields into a flow record, define an exporter specifying where to send the data, and tie them together with a monitor, which is then applied to an interface — giving flexible control over exactly what flow statistics get collected. Compared to classic NetFlow's fixed field set, it collects only the information actually needed, more efficiently.

Flip-flop

A basic sequential-circuit element that can hold one bit of information. It latches its input in sync with a clock signal and holds the output until the next clock, serving as a building block for registers, counters, and other memory circuits.

Floating IP

A public IP address that can be dynamically reassigned between instances, enabling fast failover by moving it to a healthy instance when one fails. This contrasts with a fixed IP, which stays bound to a specific instance.

Floating static route

A backup static route deliberately configured with a higher administrative distance than the primary route (dynamic or another static route) it backs up. Under normal conditions it stays out of the routing table and unused, but it is automatically installed and used the moment the primary route disappears, providing simple failover.

Floating-point errors (rounding, cancellation, loss of trailing digits)

Because floating-point numbers hold only a finite number of digits, several errors arise during computation. A rounding error comes from truncating (e.g., rounding) low-order digits that cannot be represented. Cancellation (loss of significance) is the sharp drop in significant digits when subtracting two numbers of nearly equal magnitude. Loss of trailing digits occurs when adding or subtracting numbers of vastly different magnitudes, so the smaller value is rounded away and never reflected in the result.

Floating-point number

A format for representing real numbers using a sign, exponent, and mantissa (IEEE 754 is the representative standard). It can handle a wide range of values, but cannot represent some decimal fractions exactly, leading to rounding errors.

Flooding

Flooding is the behavior by which an L2 switch forwards a frame out all ports except the ingress port, occurring when the destination MAC address is not in its MAC address table or when the destination is a broadcast/multicast address. While useful for resolving unknown destinations, excessive flooding wastes bandwidth and, in looped topologies, can trigger broadcast storms.

Flow types (automated/instant/scheduled)

Cloud flows classified by trigger: automated (event, e.g., email), instant (manual/button), scheduled (timed).

Flowchart

A diagram that lays out the steps and flow of a process in order using standardized symbols (terminals, processes, decisions, and connecting lines). It visually organizes the flow of a program or business task and clearly shows structures such as branches and loops.

Flynn's taxonomy

A framework classifying computer architectures by the number of instruction and data streams: SISD, SIMD, MISD, and MIMD. SIMD applies one instruction to multiple data items at once (vector processing, GPUs); MIMD has multiple processors independently executing different instructions on different data (multicore, distributed systems).

FM selection

Choosing the best foundation model for a use case by evaluating benchmarks, capabilities/limits (modality, context length, languages), cost, latency, and licensing—piloting comparisons when needed. The largest model isn’t always best; choose by task fit.

FMEA (Failure Mode and Effects Analysis)

A bottom-up analysis method that enumerates the possible failure modes of each component and evaluates their effect on the overall system. Because it builds up from individual component failures to system-level impact, it systematically surfaces the consequences of single failures that might otherwise be overlooked during design. It is positioned as a required analysis in the functional-safety design process.

Folder/file-level access control

OneLake security (data access roles): RBAC that grants Read or ReadWrite at the table or folder scope. Deny-by-default, with permissions inheriting to child folders.

Follow

Tracks a developer public activity in your feed.

Follow-up

An activity that later confirms how far the audited department has addressed issues raised in a systems audit. The auditor must not simply accept the audited department's self-reported improvements at face value, but should verify the effectiveness of the improvement using actual audit evidence such as records and operational status.

Forced tunneling and gateway transit

Forced tunneling routes outbound internet via on-prem with a UDR; gateway transit lets spokes share the hub’s VPN/ExpressRoute gateway.

Forecasting (Power BI)

An analytics feature estimating future values from a time series. Distinct from a reference line (baseline); requires a time series. Often paired with anomaly detection.

Foreign Data Wrapper (FDW) (postgres_fdw/file_fdw/CREATE SERVER/USER MAPPING/FOREIGN TABLE)

A mechanism for querying external data sources with ordinary SQL. postgres_fdw connects to another PostgreSQL server; file_fdw connects to files such as CSVs. CREATE SERVER defines the target connection, CREATE USER MAPPING links a local role to the external credentials, and CREATE FOREIGN TABLE defines the actual queryable foreign table.

Foreign key

A column referencing another table’s primary key to relate tables; preserves referential integrity.

fork

Copying a repository into your own account on GitHub; the start of contributing to OSS.

Fork-PR run approval

A setting requiring approval before Actions first run on a PR from an external fork; prevents unreviewed external-code execution and secret abuse.

Form

A screen element to view, enter, and edit a single record; in model-driven apps, forms are defined per table, configuring which fields show and their layout.

Form functions (SubmitForm/NewForm/EditForm)

Functions to operate a form control: SubmitForm saves input, NewForm starts a new record, EditForm switches to edit mode.

Format-preserving encryption (FPE) and pseudonymization

Format-preserving encryption (FPE) encrypts while keeping the original length/format for compatibility; pseudonymization replaces values with consistent surrogates to prevent re-identification while enabling analysis. Choose vs plain masking (irreversible hiding).

Forward Lookup

DNS resolution that maps a domain name to an IP address, using A records for IPv4 and AAAA records for IPv6. It is the counterpart to reverse lookup (which maps an IP address back to a domain name via PTR records); ordinary web access and mail delivery rely on forward lookup for name resolution.

Forward proxy

A proxy positioned on the client side that sends requests to external servers on the client's behalf; used to anonymize clients or to centrally manage and filter outbound traffic from an organization. Its direction is the opposite of a reverse proxy (used on the server side).

Foundation model

A large pretrained model usable across many tasks (e.g., GPT); multimodal handles multiple data types.

Foundry Agent Service (basics)

A managed service in Microsoft Foundry to build and run agents, combining a model, instructions (system prompt), tools (knowledge, functions), and threads to create goal-oriented AI.

Foundry evaluation and safety

Measures generative-AI quality via metrics like groundedness, relevance, and fluency plus manual evaluation, ensuring safety with content filters and risk assessment before deployment.

Four categories of controls (technical, physical, personnel, and organizational)

A classification of controls addressing risks identified in risk assessment, grouped by their nature. Technical controls are system/device-based measures such as access control and encryption; physical controls cover space and facilities, such as locks and entry management; personnel controls concern employee behavior and awareness, such as training and pledges; and organizational controls concern rules and structure, such as policies and governance bodies. No single category is sufficient alone — effectiveness comes from combining them in layered defense.

Fourth normal form (4NF)

A normal form that, in addition to satisfying BCNF, requires the absence of nontrivial multivalued dependencies. It eliminates redundant insertion of unrelated combinations that arises when two independent one-to-many relationships are combined into a single table.

Free float

The amount of time an activity can be delayed without affecting the early start date of its immediate successor. It is less than or equal to total float and indicates local slack, used when judging the immediate impact of a delay on the next activity.

Free Tier

Ways to try AWS at no cost. New accounts since July 2025 get a credit-based plan (a fixed credit amount with a time limit) granted at sign-up; the traditional model has three forms—12-month free, always-free, and trials.

Free Tier alert

AWS Billing notifications that warn by email as Free Tier usage nears its limit. For accounts created on/after 2025-07-15 under the new credit-based Free Tier, alerts fire when 50%/25%/10% of credits remain and at 15/7/2 days left in the free period. Often paired with AWS Budgets as an early warning against unexpected charges.

Frontline teams

A configuration providing a team experience suited to shifts and routine tasks for frontline workers.

FSLogix

A mechanism that stores user profiles as VHD/VHDX containers on shared storage and mounts them at logon, preserving settings/data even when signing in to a different VM each time (as in pooled). Includes Profile Container, ODFC, Cloud Cache, and application masking.

FSLogix Cloud Cache

An FSLogix feature that redundantly stores profile containers across multiple storage providers (regions/accounts), providing high availability that continues if one fails. It is not a substitute for backup (point-in-time restore).

FSLogix Profile Container

The baseline FSLogix feature that roams the entire user profile in a single container. Distinct from ODFC (Office Container), which separates only Office/Outlook data.

FTA (Fault Tree Analysis)

A top-down analysis method that places an undesired top event at the apex and decomposes the contributing factors into a tree using logic gates (AND/OR). It is the reverse approach of FMEA, and it is well suited to visualizing combinatorial risks where a serious accident occurs only when multiple failures coincide.

FTP, SFTP, and TFTP

A family of file-transfer protocols. FTP (ports 20/21) sends authentication and data in plaintext and is vulnerable to eavesdropping; SFTP transfers files securely, encrypted over SSH (port 22); TFTP (port 69, UDP) is a lightweight, unauthenticated transfer used for things like router configuration files.

Full and incremental loads

Full load replaces everything each time; incremental load ingests only changes since last run (via watermark or CDC)—incremental is efficient at scale.

Full backup

A backup method that copies all target data every time. Restoring is simple and fast, but each run takes more time and storage. It also serves as the baseline for differential and incremental backups.

Full Duplex

Full duplex is a communication mode in which transmission and reception occur simultaneously and independently, and it is the standard mode for modern switched Ethernet links using dedicated point-to-point connections. Because send and receive never contend, CSMA/CD collision detection is unnecessary and no collision domain exists. Its counterpart, half duplex, allows transmission and reception only alternately, as seen with hub connections or some wireless LAN modes.

Function (expression) index

An index built on the result of an expression or function rather than the raw column (e.g., CREATE INDEX ... ON t (lower(col))). It speeds up searches like lower(email) = 'x' that a plain column index cannot serve.

Function calling

The basic mechanism that lets an LLM use external tools or APIs. Given schemas (name, arguments, description) of callable functions, the model does not execute anything itself—it returns only a structured proposal (e.g., JSON) saying which function to call with which arguments, while the app performs the actual call and returns the result.

Function point method

A method for estimating development size and effort based on the number and complexity of a system's functions, such as screens, reports, and data files. Its distinguishing feature is that it estimates from the functional volume as seen by users, rather than relying on lines of code (LOC).

Functional dependency

A relationship in which the value of attribute A uniquely determines the value of attribute B (A→B). It is the theoretical basis of normalization: eliminating partial functional dependency (dependency on only part of the primary key) yields second normal form, and eliminating transitive functional dependency (indirect dependency via a non-key attribute) yields third normal form.

Functional requirements

Requirements that define what a system must do — the concrete features users will use, such as 'search for products' or 'register an order.' They are the counterpart to non-functional requirements, which cover quality aspects like performance and security.

Functional safety

The overarching concept — and the set of methods to realize it — of preventing electronic/electrical systems from reaching a hazardous state even when a malfunction or failure occurs, through detection and control mechanisms. It covers both hardware failures and software defects, and defines safety integrity levels (SIL/ASIL) matched to the magnitude of risk, driving design and verification to the required level of reliability.

Fusion team (with pro developers)

A team where citizen developers and professional developers collaborate, combining low-code with pro-code (Azure, custom connectors, PCF components).

Gallery

A canvas-app control that lists multiple records from a data source, repeating a template for each item (row).

Game day

An event where failures are deliberately injected so a team can rehearse real incident response. AWS Fault Injection Service (FIS) is used to safely automate chaos experiments—such as stopping instances or cutting network access—to validate the effectiveness of runbooks and alerts.

Gateway Load Balancer

A dedicated load balancer to transparently insert third-party NVAs (firewall/IDS), steering traffic to inspection NVAs.

Gateway Load Balancer (GWLB)

An L3 gateway for transparently inserting third-party virtual appliances (NGFW, IDS/IPS) into the traffic path. It encapsulates packets with GENEVE (port 6081) to the appliance fleet, and inserting a GWLB endpoint (GWLBe) into route tables routes a source VPC’s traffic to an inspection VPC.

Gateway of last resort

The forwarding destination used when no more specific route in the routing table matches a packet's destination — that is, the default route (0.0.0.0/0). It is set either by configuring a static default route or by accepting a default route advertised by a dynamic routing protocol.

gcloud CLI

Google Cloud's official command-line tool to create, configure, automate, and script resources; preinstalled in Cloud Shell.

Gemini

Google Cloud core generative AI model for text generation, summarization, code assistance, and image understanding, embedded across services and Workspace.

Gemini Cloud Assist

An AI assistant inside the Google Cloud console that analyzes logs, metrics, traces, and resource configuration to offer natural-language troubleshooting and architecture suggestions. Aimed at cutting the time operators spend investigating root causes across the console.

Gemini Code Assist

An AI pair-programming feature that assists with code completion, generation, explanation, and review inside an IDE. It has a free individual tier and an Enterprise tier that can ground completions in a private codebase and add enterprise administration. Used as an extension for VS Code and JetBrains-family IDEs.

Gemini for Google Cloud

Gemini that assists development and operations, such as code completion/explanation and cloud-ops troubleshooting.

Gemini for Google Workspace

A productivity solution embedding Gemini into Docs, Gmail, Sheets, Slides, and Meet to assist drafting, email, summarization, and meeting notes.

Gemma

Google's family of lightweight open models derived from the same research as Gemini, suited for on-device or self-hosted use and fine-tuning.

GenAI gateway

A central abstraction layer for FM consumption that unifies auth, rate limiting, cost allocation, observability, and policy—enabling secure, governed enterprise GenAI usage.

GenAI monitoring (specific metrics / golden dataset)

Quality monitoring specific to generative AI: track accuracy, grounding rate, toxicity, refusal rate, and latency/cost, and detect regressions against a golden dataset (a benchmark set of inputs and expected outputs). Combine CloudWatch, Bedrock logs, and human evaluation.

GenAIOps

An operational practice extending MLOps concepts to generative AI (Azure AI Foundry, foundation models, prompts). Prompts, agent flows, and evaluation metrics (groundedness, harmfulness, etc.) are managed as code/config in Git, with CI/CD automating the evaluate-deploy-monitor-improve cycle.

General Purpose tier

The balanced Azure SQL service tier. It separates compute from remote storage, suiting general-purpose workloads that balance cost and performance.

Generalized audit software

A general-purpose CAAT tool that lets the auditor read production data directly and perform full-population extraction, sorting, aggregation, and matching. It is well suited to exhaustive, whole-population verification, and is used to comprehensively detect outliers and exception patterns that sampling might miss. Its defining feature is versatility independent of any specific business application.

Generative AI

AI that creates new content (text, images, code) from learned data; distinct from classification/regression.

Generative AI

AI capable of generating new content such as text, images, audio, or program code. While useful for improving operational efficiency, care is needed regarding risks such as hallucination — plausibly generating incorrect information — and copyright infringement.

Generative AI app security (Bedrock Guardrails / OWASP LLM)

Added in SCS-C03. LLM-app threats are mitigated using the OWASP Top 10 for LLM (prompt injection, sensitive info disclosure, insecure output handling, excessive agency). Amazon Bedrock Guardrails apply content filters, denied topics, PII masking, contextual grounding, and prompt-attack filters to input/output. Scope InvokeModel with least-privilege IAM, make traffic private with VPC endpoints, encrypt with KMS, and audit with CloudTrail and model invocation logging. Bedrock does not retrain foundation models on customer data.

Generative AI evaluation metrics (BLEU/ROUGE)

Metrics for generated-text quality: BLEU for translation overlap, ROUGE for summarization recall, BERTScore for semantic similarity—ultimately combined with human evaluation.

Generative AI monitoring and tracing

Monitors model performance and resource consumption via diagnostic settings, records each run via tracing, and collects feedback for continuous improvement.

Generative AI production monitoring

Continuously monitors production model outputs to detect quality regressions, groundedness drift, harmful outputs, and data/prompt shifts, triggering alerts and re-evaluation.

Generative AI quality metrics and evaluation

Because generative AI output is non-deterministic, evaluation is central. AI quality metrics = groundedness (based on provided context = opposite of hallucination) / relevance (answers the question) / coherence (logic) / fluency (naturalness). Add risk/safety evaluation (harmful content/jailbreak), made into a quality gate via automated evaluation workflows with built-in + custom metrics.

Generative AI risks (toxicity/prompt injection)

Risks like toxicity, bias, hallucination, IP infringement, prompt injection, and data leakage—mitigated via guardrails and filters.

Geo-restore

A DR option restoring from GRS geo-redundant backups to another region. Because the copy is asynchronous, RPO is larger.

Geographic distribution

Distributing servers or data centers across multiple geographic regions so service can continue even during a wide-area outage such as a regional disaster or power failure; one way to increase resilience.

gh CLI

The official command-line tool to work with Issues, PRs, and repos from the terminal (uses the API).

Gist

A lightweight repository for quickly sharing a single file or code snippet.

Git

The most popular distributed version control tool; each person keeps a full local copy of the history.

Git integration (Fabric)

Connects a workspace to an Azure DevOps/GitHub repo to source-control items; the basis for version control and CI/CD.

Git integration (source control)

Connects a compute instance to a Git repository to version and collaborate on notebooks and scripts.

GitHub

A service that hosts Git repositories in the cloud and adds collaboration features like Pull Requests, Issues, review, and Actions.

GitHub Actions

A workflow platform for automating CI/CD; defined as YAML in .github/workflows and run on runners.

GitHub Advanced Security (GHAS)

A set of features protecting code, secrets, and dependencies across the SDLC. In late 2024 it was reorganized into two independent, separately licensed products—Code Security (CodeQL/code scanning) and Secret Protection (secret scanning/push protection). Dependabot and dependency/supply-chain features are free. Public repos are largely free; private/Enterprise require a product license.

GitHub App

A first-class actor for automation and integrations on GitHub. It installs per-repository and grants only the fine-grained permissions it needs, making it the recommended least-privilege choice for automation and integration development over an OAuth App. It calls the API as an installation rather than as a user, and gets its own bot identity.

GitHub Codespaces

On-demand cloud dev environments usable from a browser/editor; define the env as code with devcontainer.json.

GitHub Connect

Links GitHub Enterprise Server/Cloud with GitHub.com to enable license sync, unified search, and using Actions from the server.

github context

A context holding event/repository info; reference github.ref (branch/tag) or github.event (event payload).

GitHub Copilot

AI coding assistance across IDEs, the CLI, and GitHub.com; humans must review and decide on suggestions.

GitHub Copilot CLI

Brings Copilot to the terminal—command suggestions/explanations, shell-script generation, file operations via natural language; installed/authenticated separately from the IDE extension.

GitHub Desktop

A desktop app to handle commits, branches, and Pull Requests via a GUI; enables Git work without the command line.

GitHub Discussions

A space for conversations like questions and ideas; use Issues to track work.

GitHub Docs

The official documentation covering how features work—the primary source to check first.

GitHub Enterprise

For large organizations: groups multiple orgs centrally; comes as Cloud (GitHub-hosted) and Server (self-hosted).

GitHub Enterprise Cloud (GHEC)

The GitHub-hosted cloud edition of the Enterprise plan. GitHub operates the infrastructure, and new features and security updates typically land here before the self-hosted edition (GHES). A data residency option lets an org choose the storage region.

GitHub Enterprise Server (GHES)

The self-hosted edition of Enterprise, deployed on an organization's own data center or private cloud. Keeping data in-house helps meet compliance requirements, but features arrive via periodic feature releases and some cloud-only capabilities (e.g., certain security features) can lag or be unavailable. Administrators operate their own upgrades and backups.

GitHub Flow

A lightweight pattern: branch → commit → PR → review → merge → deploy; keep main always deployable.

GitHub Marketplace

A marketplace to find and install apps and Actions workflows that integrate with GitHub, extending capabilities like CI/CD and code quality.

GitHub Mobile

The official phone app to check notifications and triage/review Issues and PRs; Copilot Chat is also available on mobile.

GitHub Packages

Hosts packages (npm, Maven, NuGet, RubyGems, and containers via GitHub Container Registry / GHCR) close to the repo; permissions integrate with GitHub auth and Actions can publish/consume them.

GitHub Pages

Hosts a static site from a repository for free (no dynamic server logic).

GitHub Projects

A flexible planning/tracking tool spanning issues and pull requests (Projects v2). It offers board/table/roadmap views, custom fields, and built-in automation.

GitHub Security Advisory (GHSA)

Vulnerability info in the GitHub Advisory Database backing Dependabot detection. A repository security advisory lets you fix a vulnerability in your own project privately and then publish it.

GitHub Skills

Official hands-on courses where you learn by doing.

GitHub Sponsors

A way to financially support OSS developers/projects; separate from Star (a free bookmark).

GitHub Support

The channel for outages, bugs, and GHES system failures that admins can’t resolve via settings/permissions. First triage issues into "admin-solvable" vs "Support case."

GitHub usage metrics

Reports that surface consumption—Actions minutes, Packages/Codespaces storage, and license (seat) usage—for billing and optimization, viewed in enterprise/organization billing and usage reports.

GITHUB_TOKEN

A temporary, scoped credential auto-issued per workflow run; scope it to least privilege via permissions (e.g., contents: read) and elevate only jobs needing writes. Avoid long-lived PATs.

GitHub-hosted runner

An ephemeral VM that GitHub provisions, updates, and tears down; clean per job, suited to general CI. Usage-billed (with free minutes).

github.dev

An in-browser lightweight editor opened by pressing "." on a repo; it has no compute.

GitOps

An operations approach treating a Git repo as the single source of truth and continuously reconciling to the declared desired state, preventing drift from manual changes.

GKE Autopilot

A GKE cluster mode where Google fully manages node provisioning, scaling, upgrades, and hardening. Billing is per-Pod, and you lose node-pool tuning and SSH access in exchange for minimal operational overhead.

GKE Enterprise (Anthos)

A platform to operate and manage containers consistently across on-premises and multiple clouds, enabling hybrid and multicloud.

GKE Standard

A GKE cluster mode where you configure node-pool machine types, scaling settings, and even SSH access to nodes yourself. More flexible than Autopilot, but node capacity management and some security patching become your responsibility.

Glacier retrieval tiers

Restore-speed options from S3 Glacier classes. Glacier Instant Retrieval = immediate; Flexible Retrieval = expedited (1–5 min)/standard (3–5 h)/bulk (5–12 h); Deep Archive = standard 12 h/bulk 48 h. Choose by speed-vs-cost trade-off.

Global Unicast Address

An IPv6 address that is globally routable and unique across the Internet, falling within the 2000::/3 range — the IPv6 counterpart to an IPv4 global address. Unlike a link-local address, it is reachable across routers and can be auto-configured via SLAAC or DHCPv6.

Glue crawler

Scans data sources to infer schema and partitions, automatically registering/updating table definitions in the Glue Data Catalog.

Glue Data Catalog

A central metadata store of tables, schemas, and partitions, referenced as shared metadata by Athena, Redshift Spectrum, and EMR.

Glue Data Quality (DQDL)

Validates and scores data quality on the catalog or in pipelines against rules expressed in DQDL (a rule definition language).

Gmail (administration)

Workspace's email service. Admins configure routing/receiving rules, content and attachment restrictions, check delivery status, and analyze message headers (to investigate spoofing).

Gmail routing

A Gmail setting that forwards/routes mail matching conditions to another destination/server; used with content/attachment restrictions for compliance.

GnuPG (gpg)

A public-key tool to encrypt, decrypt, and sign files. Encrypt with the recipient public key (gpg -e -r recipient) so only they can decrypt with their private key; sign with your own private key. The keyring is ~/.gnupg/, with gpg-agent managing passphrases.

Gold layer

The final medallion layer; aggregation and business logic make report/analytics-ready data (often a dimensional model).

Google Chat

Team messaging in Google Workspace with direct messages and spaces; admins control history, external participation, and moderation.

Google Cloud Armor

Edge/backend security policies applied in front of an external Application LB; provides WAF (SQLi/XSS/RFI), advanced DDoS protection with ML-based Adaptive Protection, rate limiting, bot management, and Threat Intelligence.

Google Drive (sharing settings)

Workspace's file storage. Admins control sharing scope (internal/external, link sharing), allow/restrict sharing, and shared-drive usage—configurable per OU or group.

Google Kubernetes Engine (GKE)

Managed Kubernetes that operates many containers at scale with automated placement, scaling, and self-healing.

Google SecOps (SIEM/SOAR)

Formerly Chronicle. A security-operations platform with a SIEM (ingest large security logs, detect/investigate via rules) and SOAR (automate/orchestrate response via playbooks); integrated with Security Command Center.

Google SecOps Risk Analytics

Assigns risk scores to detections, discovers anomalous asset/user behavior, and prioritizes threats matching a risk profile; finds anomalies via spikes in entity risk score.

Google Threat Intelligence (GTI) and IOCs

Threat intelligence providing known malicious IPs/domains/hashes (IOCs—indicators of compromise) and actor TTPs; used in detection, hunting, and forensic analysis to judge artifact maliciousness.

Google Vault (retention rules and holds)

Handles retention rules (retain for a period, then delete) and holds (preserve data for litigation/investigation). A hold overrides retention deletion; preserved data is searched/exported via eDiscovery.

Google Zero Touch Enrollment

A mechanism where supported Android devices, registered with Google's portal via a reseller, automatically pick up a management profile from any EMM (DPC) such as Intune on first boot. It's a generic enrollment method provided by Google, not tied to a specific EMM, and reaches a fully managed configuration with no user interaction, suiting bulk corporate procurement deployments.

Governed rollout

Safely releasing generative AI to production: centralize the entry via an API gateway/proxy (auth, rate limiting, logging, model switching), embed evaluation gates in CI/CD, and roll out in stages with A/B and canary—rolling back instantly on issues.

GPIO (General-Purpose I/O)

A general-purpose digital input/output pin whose direction (input/output), pull-up/pull-down configuration, and other settings can be switched by software through registers. Because it has no fixed dedicated function, it can be freely assigned to a purpose — reading a switch, driving an LED, or controlling a simple external device — making it the most basic I/O mechanism in embedded systems.

Graceful degradation

Designing so partial failures don’t cause a full outage—keeping running with reduced functionality (serving cached data, disabling non-essential features, default responses) to minimize user impact.

Gradient boosting

An ensemble technique that sequentially adds weak decision trees, each one trained to reduce the errors left by the trees before it (flagship implementations: XGBoost, LightGBM). A strong default for tabular data, and offered as a built-in algorithm by many managed ML services.

Gradient descent

An optimization algorithm that minimizes a loss function by repeatedly stepping the parameters opposite the loss gradient, with step size set by the learning rate. Variants include full-batch, per-example stochastic gradient descent (SGD), and mini-batch processing.

Grain

The level of detail one fact row represents (e.g., one transaction, one product per day); decided first and key to correct aggregation.

GRANT / REVOKE

DCL statements that grant or revoke privileges on objects such as tables to a role. GRANT SELECT grants a single privilege, while GRANT ALL grants all privileges at once.

Graph and Graph Search

A graph is a data structure of vertices (nodes) and edges representing many-to-many relationships such as networks or dependencies. Graph search systematically visits vertices or paths: breadth-first search (BFS) uses a queue to explore layer by layer from the nearest vertices, while depth-first search (DFS) uses a stack or recursion to explore paths deeply before backtracking. BFS suits shortest-path problems with uniform edge weights, while DFS suits connectivity checks and cycle detection.

Graph database

A NoSQL model that stores data as a graph of nodes (entities) and edges (relationships). It efficiently handles queries that traverse many-to-many relationships, such as social-network connections or recommendations.

GRE (Generic Routing Encapsulation)

An encapsulation-only tunneling protocol that wraps an entire original packet inside a new IP header. It lets traffic that could not normally be carried directly across the internet — multicast or other protocols, for instance — pass through the tunnel, but GRE itself provides no encryption. Where confidentiality is required, it is paired with IPsec (GRE over IPsec).

Ground Truth and build-vs-buy

SageMaker Ground Truth labels training data, ensuring quality via workforces (Mechanical Turk = public, cheap but not for confidential / vendor-managed / private = internal for confidential), automated labeling (active learning sends only ambiguous examples to humans to cut cost), and annotation consolidation (majority vote). Choose the build strategy on a spectrum: AI service (common tasks, no training, fastest) → each service’s Custom → full-custom SageMaker (unique requirements).

Grounding with Google Search

A grounding approach that bases answers on Google Search to reflect recent general information and reduce hallucination.

Group Policy analytics

An Intune feature that imports and analyzes existing on-prem GPOs (Group Policy Objects) to assess whether each setting can migrate to an Intune MDM setting. It surfaces unsupported or deprecated settings for pre-migration planning (analysis only—actual conversion/application is a separate step).

Grouping and aggregation (transform)

Transforms that group by keys to compute sum/count/average; used to build gold-layer and report-ready data.

Grouping and auto-dismiss (dependency updates)

Grouping combines related dependency updates into one PR to cut noise; auto-dismiss drops low-risk alerts by conditions (too loose dismisses real risk). Configure update strategy in dependabot.yml.

Groups and admin roles

A group bundles mailing list, sharing, and permission grants (not for hierarchical policy differentiation). Admin roles include the super admin (kept minimal) and predefined/custom roles delegated with least privilege; OUs differentiate/inherit policy by hierarchy.

gRPC

A low-latency, typed (Protocol Buffers) RPC framework over HTTP/2, suited to internal service-to-service calls; choose REST for public web.

GuardDuty detector / threat lists

A detector enables GuardDuty per Region, analyzing CloudTrail, VPC flow logs, and DNS logs with ML and threat intelligence. You can add trusted IP lists (suppress false positives) and threat IP lists (custom block targets).

GuardDuty findings and Security Hub

GuardDuty analyzes VPC flow logs, DNS logs, and CloudTrail via ML/threat intel to detect threats. Security Hub aggregates findings from multiple security services and assesses conformance to standards (CIS/PCI).

Guest access

Invites external users into Teams or SharePoint to collaborate, handling external identities via B2B collaboration (Entra External ID).

GUI / CUI

GUI is graphical desktop operation; CUI (CLI) is text-based command operation. Servers usually run the lightweight CUI, with GUI reserved for desktop use.

H-bridge circuit

A driver circuit that arranges four switching elements in an H-shaped configuration, allowing the direction of current through a load such as a motor to be reversed, enabling forward, reverse, brake, and coast states. It is the basic building block of a motor driver used to control high-current motors — which an MCU's digital output alone cannot drive — in combination with a PWM signal.

HA (high-availability) configuration

A configuration designed to minimize downtime of servers or services, combining redundancy, clustering, and load balancing to eliminate single points of failure (SPoF) and raise availability.

HA VPN

Google's recommended IPSec VPN, providing a 99.99% availability SLA via two redundant tunnels (each with its own external IP). Used to connect to on-prem, other clouds, or other VPCs, and assumes dynamic routing via BGP. The default choice for new deployments.

Half adder and full adder

A half adder adds two 1-bit inputs to produce a sum and carry-out, but has no carry-in. A full adder adds three inputs (two bits plus a carry-in) to produce sum and carry-out, and can be built from two half adders plus an OR gate. Multi-bit adders chain full adders together.

Hallucination

When generative AI confidently produces plausible but incorrect content; mitigate with human review and RAG.

Hamming code

An error-correcting code that adds several check bits to data so a single-bit error can be automatically corrected. The combination of each check bit's parity result (match/mismatch) — the syndrome — locates and corrects the erroneous bit. Basic Hamming corrects one bit only; adding a single overall parity bit gives extended Hamming (SECDED), which corrects one bit and detects two, unlike plain parity checking (detection only).

HANA System Replication (HSR)

SAP HANA’s DB-native sync/async replication from primary to secondary, used for HA (same/near region) and DR (another region). HANA DR is recommended via HSR, not Azure Site Recovery.

Hard and symbolic links (ln)

Multiple names for one entity: a hard link (ln) is an equal name for the same inode—same filesystem only, no directories, and data survives deletion. A symbolic link (ln -s) is a file holding a path—it can cross filesystems and point at directories, but dangles if the target is removed.

Hard real-time / soft real-time

A classification based on how tolerant a system is to missed deadlines. Hard real-time requirements are strict: even a single missed deadline can cause system failure or an accident (e.g., airbag control). Soft real-time requirements tolerate missed deadlines as mere performance degradation (e.g., video playback). This classification drives the choice of scheduling policy and verification method.

Hardening

The work of reducing a system's attack surface and making it harder to attack, by disabling unnecessary services, changing default passwords, applying the latest patches, and enforcing least privilege.

Hash function (tamper detection)

A function that computes a fixed-length value (a hash value) from data of arbitrary length. The same input always produces the same output, and even a tiny change drastically alters the value, which is why hash functions are used for tamper detection and password storage.

Hash index

An index type that determines storage location from a hash of the key value. Equality lookups (=) are extremely fast, but the index cannot support range searches or sorting — the main contrast with a B-tree index.

Hash join

A join algorithm that builds an in-memory hash table from the smaller table's join column, then scans the larger table, probing the hash table for matches. It is limited to equality joins but is fast for joining large, unsorted tables.

Hashing

A one-way, non-reversible transform; used for password storage and tamper detection (cannot be decrypted, unlike encryption).

Hashing

A data structure technique that uses the value produced by applying a hash function to a key as the storage position in an array, achieving average O(1) search and insertion. It requires a way to handle collisions, where different keys map to the same position.

HDD / SSD

Mass storage: an HDD is a magnetic disk—cheap and large but with moving parts and slower; an SSD uses flash memory—fast and shock-resistant but with limited write cycles. Optical storage (DVDs) is for distribution/archival.

HEAD

A reference to the currently checked-out branch/commit—your current position.

Head-of-Line Blocking

Head-of-line (HOL) blocking occurs when the packet or request at the front of a queue is delayed for some reason (e.g., receiver buffer exhaustion, waiting for in-order delivery), stalling all subsequent packets or requests behind it even though they could otherwise be processed. It arises with shared single FIFO queues, TCP's in-order delivery guarantee after packet loss, and HTTP/1.1 pipelining, and is mitigated by techniques such as virtual output queuing (VOQ) or HTTP/2+ multiplexing.

Health Check

A health check is a mechanism used by load balancers and redundant configurations to periodically verify that backend servers or devices are responding correctly. L4 health checks simply test whether a TCP connection can be established, while L7 health checks send an HTTP request and validate the status code or response content; targets detected as unhealthy are automatically excluded from traffic distribution or failover.

Health check types and thresholds

Designing health determination: shallow checks (process liveness) vs deep checks (real functionality including dependencies). Healthy/unhealthy thresholds (consecutive successes/failures) confirm state and reduce flapping; interval and timeout are tuned too. Used by ELB, Route 53, and Auto Scaling.

Health checks (liveness/readiness) and HPA

A liveness probe restarts unhealthy Pods; a readiness probe withholds traffic until ready. The Horizontal Pod Autoscaler (HPA) scales Pod count with load (node count = Cluster Autoscaler).

Heapsort and Heap Property

The heap property states that in a complete binary tree, each parent node's value is always greater than or equal to (max-heap) or less than or equal to (min-heap) its children's values. Heapsort exploits this property by building an array into a heap and repeatedly extracting the root (the maximum or minimum), producing a sorted array; it guarantees O(n log n) worst-case complexity and needs almost no extra memory, unlike quicksort.

Hello/Dead timer (OSPF)

Two timers that govern how OSPF confirms a neighbor is alive. Routers exchange Hello packets at the Hello interval; if no Hello arrives within the Dead interval (by default four times the Hello interval), the neighbor is declared down and routes are recomputed. Mismatched Hello/Dead timer values between neighboring interfaces prevent adjacency from forming.

Herzberg's motivation-hygiene theory

A theory that separates "motivator" factors related to job satisfaction (achievement, recognition, the work itself) from "hygiene" factors that address dissatisfaction but do not by themselves create satisfaction (pay, working conditions). It is important as the basis for judging that improving hygiene factors alone is not sufficient to raise team motivation.

hidden node problem

In wireless LANs, a condition where two stations cannot detect each other's transmissions, so carrier sense (CSMA/CA) fails and both may transmit to the same AP simultaneously, causing collisions. The RTS/CTS handshake mitigates this by reserving the medium before data transmission.

HIDS (host-based intrusion detection) and antimalware

A HIDS (host-based intrusion detection system) is software running on an individual host that watches file changes, processes, and logs for signs of intrusion. Antimalware (AV) is software that detects, quarantines, and removes known and unknown malware using signatures and behavior. Both operate at the endpoint rather than the network perimeter.

Hierarchical partition key

A partition design splitting data by up to three levels (e.g., tenant→user→session) to scale beyond the 20 GB logical-partition limit while enabling efficient queries on a leading prefix. Different in purpose from a synthetic partition key (for single-key skew).

Hierarchy (semantic model)

A drill-down structure defined in the model (year→quarter→month, country→city); used for drilldown in reports.

High availability (HA)

Designing so a service keeps running despite failures (redundancy, availability zones, etc.).

Hit rate and access time (effective access time)

The hit rate is the fraction of data requests the CPU can satisfy from cache memory; the remaining fraction is the miss rate (= 1 − hit rate). Effective access time is computed as (hit rate × cache access time) + (miss rate × main-memory access time); a higher hit rate shortens the average access time and speeds up processing.

HMAC (keyed-hash message authentication code)

A scheme that generates a message authentication code (MAC) by combining a shared secret key with a hash function. The receiver recomputes it with the same key to verify integrity and that the message came from a party holding the key, providing integrity and authenticity without a public-key infrastructure.

Honeypot

A decoy system deliberately made to look vulnerable, set up to lure attackers so their techniques, tools, and intrusion routes can be observed and analyzed. It allows attack intelligence to be gathered without exposing production systems to real harm.

Horizontal scaling (scale out)

Scaling by adding more instances to spread the load. It assumes a stateless design plus a load balancer and auto scaling, and since one instance failing doesn't take down the whole system, it also improves fault tolerance. Considered the default direction in cloud-native design.

Host key

The key pair (/etc/ssh/ssh_host_*_key) an SSH server holds to prove its own identity. On connecting, clients check this key's fingerprint against known_hosts to detect impersonation or man-in-the-middle attacks.

Host pool (pooled/personal)

In Azure Virtual Desktop, a collection of identically configured session hosts (VMs). Pooled is shared by multiple users (multi-session, cost-efficient); personal dedicates one host per user and preserves state.

Host pool load balancing (breadth-first / depth-first)

How a pooled host pool assigns new sessions. Breadth-first spreads across all hosts for an even experience; depth-first fills one host to its limit before the next, reducing VM count and cost.

Hotpatch

An update method that applies security updates to supported Windows editions (requires Enterprise E3/E5, etc.) without a restart. Compared to traditional monthly updates, it reduces restart-driven downtime and productivity loss, and is used alongside a periodic baseline update cycle that still requires occasional restarts.

HSM (Hardware Security Module)

A tamper-resistant device that generates, stores, and performs operations with cryptographic keys entirely within dedicated hardware, preventing private keys from ever being extracted to software or the outside. Because the private key is never held in plaintext in OS or application memory, it greatly reduces the risk of key leakage even if malware infects or a server is breached. It is a representative implementation of the "storage" stage of the key management lifecycle.

HSRP (Hot Standby Router Protocol)

Cisco's proprietary protocol implementing an FHRP. Within a group, the router with the highest priority becomes the active router and owns the virtual IP/MAC address, while the runner-up waits as the standby router. Whether a recovered former-active router automatically reclaims control is governed by the preempt setting.

HTTP

The unencrypted application-layer protocol (port 80) that browsers and servers use to exchange pages and data. Because its traffic is plaintext and open to eavesdropping or tampering, using TLS-protected HTTPS is now the standard.

HTTP connector

A general connector that calls any web API directly; integrates over REST with services lacking a dedicated connector. Premium.

HTTP methods and HTTP status codes

An HTTP method expresses the intent of a request (GET to read, POST to create, PUT to replace wholesale, PATCH to update partially, DELETE to remove). An HTTP status code expresses the outcome of a response (2xx success, 3xx redirect, 401 unauthenticated, 403 forbidden, 404 not found, 429 rate limited, 5xx server error). Troubleshooting an API call means isolating the cause from the combination of the method you sent and the status code you got back.

HTTP/3 (QUIC)

HTTP that uses UDP-based QUIC (instead of TCP) as its transport. Because each stream in QUIC handles retransmission and ordering independently, it avoids the transport-layer head-of-line (HoL) blocking of HTTP/2 over TCP (where one stream's loss stalls all streams), which is advantageous on lossy links.

HTTPS

HTTP carried on top of TLS. Unlike plain HTTP, the traffic is encrypted, preventing eavesdropping or tampering along the path. Browsers verify the certificate to confirm the server's legitimacy, and it's now the standard way sites communicate.

Hub-spoke network topology

A design that centralizes shared services (firewall, gateway, DNS) in a hub VNet with spoke VNets connected by peering; can also be realized in a managed way via Virtual WAN.

Huffman coding

A variable-length coding scheme that minimizes the average code length of a data set by assigning shorter codewords to frequently occurring symbols and longer codewords to rare ones. Because no codeword is a prefix of another (a prefix code), boundaries between codewords can be uniquely determined during decoding. It is a representative entropy coding method used for lossless compression.

Human interface

The overall point of contact — and the technology for designing it — through which people and machines (computers) exchange information. It spans GUIs, voice UIs, and gesture controls, aiming to let users operate systems intuitively and without error.

Human resource management

Management activities that help a company make effective use of its people. Through recruitment, placement, training, evaluation, and compensation, it aims to develop employees' abilities and translate them into organizational results.

Human-in-the-loop

Keeping a person to make the final check/approval rather than using AI output as-is for important decisions; essential for high-impact uses.

Hunting graph

"Hunting graph" is an official feature within Microsoft Defender advanced hunting. It visualizes entities (devices, users, IP addresses, etc.) and their relationships as nodes and edges, rendering threat scenarios as interactive graphs to make it easier to trace chains of attack. It's a visualization layer over KQL query results that helps analysts manually follow how a compromise spread.

Hybrid cloud

Combining and linking public with private (on-prem); balances regulation with cloud flexibility.

Hybrid cryptography

A scheme that combines the processing speed of symmetric-key cryptography with the secure key distribution of public-key cryptography. The data itself is encrypted with a symmetric key, and that symmetric key is then encrypted with the recipient's public key before being sent. Used in S/MIME, PGP, and TLS 1.2 and earlier (note that current TLS 1.3 uses (EC)DHE key exchange and no longer sends a symmetric key encrypted under a public key).

Hybrid DNS (forwarding zones/inbound policy/DNS peering)

Configurations for bidirectional name resolution between on-prem and Cloud DNS: forwarding zones query on-prem from cloud, inbound server policy resolves cloud from on-prem, and DNS peering references a zone in another VPC.

Hybrid identity (Entra Connect)

Syncs on-prem Active Directory with Entra ID for hybrid identity. Choose authentication among password hash sync, pass-through authentication, and federation (AD FS).

Hype cycle

A model, developed by Gartner, that traces the trajectory of expectations for an emerging technology through five stages: the technology trigger, the peak of inflated expectations, the trough of disillusionment, the slope of enlightenment, and the plateau of productivity. Strategists use it to judge which stage a buzzed-about technology currently occupies, so as to avoid rushing into investment while it sits at the peak of inflated expectations, and to time investment for once it has survived the trough and entered the slope of enlightenment.

Hyperparameter optimization (HPO)

Automatically searching settings fixed before training (learning rate, tree depth, regularization, etc.) to optimize a metric—via grid/random search, Bayesian optimization, and early stopping. SageMaker Automatic Model Tuning is the prime example; evaluate on validation data to avoid overfitting.

Hyperscale tier and page servers

An Azure SQL service tier scaling to ~100TB. Page servers separate storage to enable snapshot-based fast backup/restore and rapid scaling.

Hypervisor

Software that virtualizes a physical machine CPU/memory/disk and shares them among virtual machines; it uses CPU virtualization extensions (Intel VT-x / AMD-V) for practical speed. On Linux, KVM plays this role.

Hypervisor (Type 1 / Type 2)

A classification of the software that runs virtual machines. Type 1 (bare-metal, such as ESXi) installs directly on hardware with no host OS in between, giving better performance and isolation, and is the mainstream choice for server virtualization. Type 2 (hosted, such as VirtualBox) runs as an application on top of an existing host OS, making it easy to install but adding more overhead since it goes through the host OS, so it is used mainly for testing or desktop use. A virtual switch sits above this layer, connecting virtual machines to each other and to the physical uplink.

Hypothesis testing

A method for judging, from sample data, whether a hypothesis about a population is statistically valid. The hypothesis one wishes to reject is set up as the null hypothesis and the one to adopt as the alternative hypothesis; one compares the probability of the observed result under the null hypothesis (the p-value) against a significance level, rejecting the null hypothesis when the p-value is smaller. Errors of judgment include a Type I error (rejecting a true null hypothesis) and a Type II error (accepting a false null hypothesis).

I/O interface (USB, HDMI, Bluetooth)

Standards for connecting a computer to peripheral devices. USB is a general-purpose wired standard for a wide range of devices such as mice and memory sticks; HDMI transmits video and audio together to displays and the like; Bluetooth is a standard for wirelessly connecting nearby devices without cables (earphones, etc.).

I2C (Inter-Integrated Circuit)

A serial communication standard that connects multiple devices using just two signal lines, SDA (data) and SCL (clock). By assigning each device an address, many sensors or ICs can share a single bus, minimizing wiring, though throughput is lower than SPI. It supports arbitration for multi-master configurations. It suits requirements calling for low speed with many connected devices.

IaaS (Infrastructure as a Service)

Renting infrastructure such as VMs; you manage the OS and above—the most control (e.g., Azure Virtual Machines).

IaC tools (Terraform / Helm)

Beyond Bicep/ARM, pipelines apply multi-cloud Terraform (declarative, state management) and Kubernetes Helm charts to codify infrastructure and app configuration.

IAM Access Analyzer

A service supporting least privilege via external-access analysis (detect externally exposed S3/roles/KMS/Secrets), unused-access analysis (surface unused roles/permissions/access keys), policy validation, and least-privilege policy generation from CloudTrail.

IAM condition keys

Keys used in a policy’s Condition: aws:SourceIp (source IP), aws:MultiFactorAuthPresent (require MFA), aws:PrincipalTag/ResourceTag (ABAC), aws:SourceVpce (via a specific endpoint), etc. The crux of fine-grained access control.

IAM deny policies and IAM conditions

IAM deny policies explicitly forbid actions and take precedence over allows (a hard guardrail); IAM conditions make grants conditional on attributes (time/source IP/resource). Together they refine least privilege.

IAM group

A container that bundles multiple IAM users so policies can be attached in bulk. A group is not itself a principal and cannot assume a role—it only simplifies distributing permissions to users. Groups cannot be nested inside other groups.

IAM Identity Center (formerly AWS SSO)

Centrally manages access across multiple AWS accounts and applications. It integrates with external IdPs and grants cross-account access centrally via permission sets.

IAM inline policy

A policy embedded directly inside a single IAM user, group, or role, tied strictly one-to-one to that identity. It can't be attached to or reused by another identity, and it disappears when its identity is deleted. It's used for narrow cases where exactly one identity needs an exceptional permission.

IAM managed policy

A standalone policy object that can be attached to and reused across multiple IAM users, groups, and roles. It splits into AWS managed policies (created/updated by AWS—quick but coarse-grained) and customer managed policies (self-authored and versioned—recommended, and easier to make least-privilege).

IAM policy evaluation logic

The order for deciding access: an explicit Deny always denies (highest precedence); otherwise check for an explicit Allow; allow if Allowed and not Denied; with no Allow anywhere it is implicitly denied. Precedence: explicit deny > allow > implicit deny.

IAM Policy Simulator

A tool that evaluates whether a given principal would be allowed an action—without making the real request—for pre-deployment permission testing.

IAM policy structure (Effect/Action/Resource/Condition)

Elements of a JSON policy: Effect (Allow/Deny), Action (APIs like s3:GetObject), Resource (target ARNs), Condition (IP, MFA, tags, etc.), and Principal (who—resource policies only). Least privilege narrows these to specifics.

IAM user

A long-lived identity representing a person or application that can hold long-term credentials such as a password or access keys. Best practice favors roles with temporary credentials for people, keeping the number of IAM users and long-term keys to a minimum.

IAST (Interactive Application Security Testing)

A method that detects vulnerabilities while measuring internal behavior (data flow and actually reached code paths) during application execution. Positioned between SAST (static code inspection) and DAST (external dynamic testing), it combines the strengths of both.

ICMP

A protocol for control and diagnostic messages rather than data transfer. It powers ping (reachability checks) and traceroute (path checks), and carries unreachable/TTL-exceeded notifications—essential for diagnosing network connectivity issues.

Icon (control)

A control showing symbol icons (arrow, trash, edit) that can run actions when pressed; used as small action buttons.

Idempotency

A property where repeating the same operation any number of times yields the same result. Distributed systems often duplicate requests via network retries; an idempotent design (e.g., using an idempotency key) lets duplicate delivery be handled safely.

Idempotency key pattern

A design pattern where the client attaches a unique key to each request and the server caches that key's result so a resend with the same key is not re-executed. It guards against network retries or SQS at-least-once delivery causing the same operation (e.g., a duplicate payment) to run twice; a common implementation checks first-use of the key with a DynamoDB conditional write.

Idempotent HTTP methods

A property of HTTP methods: GET/PUT/DELETE are idempotent (same result no matter how many times called); POST is non-idempotent (may create on each call). Important for retry design—idempotent operations can be safely resent; non-idempotent ones use an idempotency key to prevent duplicates.

Identification, authentication, and authorization (three-stage model)

Access management consists of three distinct steps. Identification is where a user claims an identity (e.g., entering a user ID). Authentication verifies that the claimant really is who they claim to be, using a password, biometrics, etc. Authorization then grants an authenticated user specific rights to specific resources. Conflating the three can lead to a design flaw where breaching authentication alone grants unrestricted access.

Identifying and resolving errors (Fabric)

Operationally isolating and fixing errors in pipelines/Dataflows Gen2/notebooks/Eventhouse/Eventstream/T-SQL/shortcuts from run logs and messages.

Identity provider (IdP)

A corporate auth platform (Entra ID, Okta, etc.) that handles authentication via SAML SSO and, combined with SCIM/team sync, centrally manages accounts and groups.

Identity Secure Score

A numeric measure of identity posture in Microsoft Entra ID. It shows the current score and recommended improvements, guiding actions like enforcing MFA or Conditional Access.

Identity-Aware Proxy (IAP)

Protects access to apps/resources based on user identity; exposes apps securely without a VPN, enabling zero-trust-style access control.

Identity-based policy

A policy attached to an IAM user, group, or role that defines what that principal can do. It comes as managed policies (AWS- or customer-managed) or inline policies, and is the basic form of granting permissions within the same account.

IdFix

A pre-sync cleansing tool that detects/fixes on-prem AD format errors/duplicates (invalid UPNs, duplicate proxy addresses, illegal characters) before syncing to Microsoft Entra ID.

IDS and IPS

An IDS (intrusion detection system) detects unauthorized traffic and alerts an administrator, while an IPS (intrusion prevention system) additionally blocks the traffic automatically. Both are used to defend network boundaries and critical servers.

IDS/IPS detection methods (signature-based / anomaly-based)

Signature-based (misuse) detection flags traffic matching known attack patterns (signatures); false positives are low, but unknown attacks are missed. Anomaly-based detection flags traffic that deviates from a statistical baseline of normal behavior; it can catch unknown attacks but tends to have a higher false-positive rate, flagging legitimate traffic as anomalous.

IEC 61508

The international basic standard for functional safety of electrical/electronic/programmable electronic (E/E/PE) safety-related systems. It is a general-purpose standard applied across industrial equipment, defining Safety Integrity Levels (SIL) 1 through 4 based on risk magnitude, along with requirements for the design process, verification, and failure rates. It underlies industry-specific derivative standards such as ISO 26262 for automotive.

IEEE 802.1X (port-based authentication)

A standard for per-port LAN access authentication. Until the supplicant (device) is authenticated by an authentication server (RADIUS), the switch port permits only EAPoL authentication traffic and blocks normal data traffic; the port opens after success. EAP-TLS is a strong mutual-authentication method using client certificates.

if (conditional) and status functions

Controls whether a job/step runs via an expression; status functions success()/failure()/cancelled()/always() express failure-only, always, etc.

If function (Power Fx)

Returns different values depending on whether a condition is true; used for show/hide, coloring, and validation.

IGMP (v2 / v3)

A protocol by which a host tells a router which multicast group it wants to join. IGMPv2 handles only group-level Join/Leave, whereas IGMPv3 can also specify a particular source when joining a group, which is required for SSM (source-specific multicast) to work at all.

ignore_system_indexes / ignore_checksum_failure

Startup troubleshooting flags for emergency access to a corrupted cluster. ignore_system_indexes ignores broken system-catalog indexes, falling back to sequential scans instead. ignore_checksum_failure lets reads proceed past a detected data-checksum mismatch instead of erroring out — a high-risk setting that tolerates data corruption.

IKE policy

The Internet Key Exchange settings that define how an IPsec tunnel exchanges keys—encryption algorithm, hash, Diffie–Hellman group, and SA lifetime—must match on both the on-prem device and the cloud-side VPN gateway.

Image (control)

A control that displays images—static, captured from the camera, or sourced from data.

Image analysis (tags, captions, object detection)

Image analysis in Azure AI Vision: select visual features to tag images, generate captions, detect objects, and use smart crop to extract key regions.

Imagen

Google image-generation model that creates new images from text instructions.

IMAP and POP3

Mail-retrieval protocols. POP3 downloads mail to a device and deletes it from the server, suiting a single device. IMAP keeps mail on the server so devices share state (read status, folders), suiting multi-device use. Both should be encrypted with TLS to protect credentials.

Immutable actions

Makes a released action version unchangeable so a referenced version cannot be swapped later; with SHA pinning, strengthens supply-chain safety.

Immutable infrastructure

An operating model that never modifies running servers—instead it rebuilds and replaces them from a new image (AMI/container). It eliminates configuration drift, and rollback is just reverting to the prior version; pairs well with blue/green and Auto Scaling.

Impact analysis (downstream dependencies)

Analysis to foresee how changes to lakehouses/warehouses/dataflows/semantic models ripple to downstream reports.

Implicit deny (ACL)

A rule that automatically exists at the end of every ACL, denying all traffic that matched no earlier entry, even though it is never written explicitly. If an administrator defines no permit conditions at all, all traffic on the interface where the ACL is applied is unintentionally blocked, making it essential not to forget to explicitly permit the traffic that should be allowed.

Import mode

Loads and keeps data in the model’s memory; fastest but requires a refresh schedule to reload data.

Import/export data (Dataverse)

Loading from Excel/CSV into tables or exporting from them, with column mapping and duplicate detection; Dataflows enable recurring ingestion.

Improvement recommendation (audit finding)

A proposal by which the auditor, having identified the facts, causes, and impact (risk) of an internal control deficiency, urges the audited department to make improvements. The auditor only recommends; designing and implementing the actual control remains the responsibility of the audited department. If the auditor were to implement the corrective measures themselves, it would impair independence and must be avoided.

In-memory database

A database that keeps data primarily in main memory rather than on disk. Removing the disk I/O bottleneck makes reads and writes orders of magnitude faster, but a separate persistence design (logging, snapshots) is needed to guard against data loss on power failure.

In-Region resilience (capacity/throttling)

Designing generative-AI calls to withstand capacity pressure and throttling: capacity reservation (provisioned throughput), queue + exponential-backoff retries, fallback across models, and cross-Region inference—maintaining availability.

Inbound NAT rule

A Load Balancer rule that forwards traffic on a specific frontend port to a specific port on one VM in the backend pool—pinpoint forwarding, unlike a load-balancing rule's distribution across many backends. Commonly used to expose RDP/SSH to individual VMs.

Incident lifecycle

The sequence of stages an incident passes through from detection and logging to closure: detection/logging, categorization and prioritization, investigation and diagnosis, resolution and recovery, and closure. Following each stage reliably prevents gaps in handling and leaves a record that feeds problem management and knowledge accumulation.

Incident management

The process aimed at restoring normal service operation as quickly as possible within agreed service levels after an unplanned interruption or quality degradation (an incident). It proceeds through logging, categorization, investigation, recovery, and closure, using workarounds when needed. Determining root cause belongs to problem management; incident management prioritizes fast recovery.

Incident management and investigation

Correlates related alerts into incidents, investigates via entities, timelines, and attack stories, and drives triage → containment → remediation.

Incident management and problem management

Incident management quickly detects service disruptions and restores service as fast as possible. Problem management identifies the root cause of incidents and puts measures in place to prevent recurrence. The key distinction is their goal: rapid restoration versus preventing recurrence.

Incident priority (impact and urgency)

The measure that sets the order of handling incidents, derived from the combination of impact (breadth of harm and business damage) and urgency (how little time it can be left unaddressed). Higher-priority items receive resources first. Tied to SLA target times, it guides how to allocate limited staff most effectively.

Incident response and forensics

The AWS incident-response flow and evidence preservation: prepare (playbooks/IR roles/always-on logs) → contain (isolation SG/quarantine VPC, disable credentials) → preserve evidence (volatile memory → EBS snapshot, stop not terminate) → analyze in an isolated environment. Immediate termination loses evidence.

Incident response process

A predefined sequence for handling a security incident: detection, triage (priority assessment), containment, eradication, recovery, and a post-incident review that feeds lessons learned back into the process. It prevents delayed or ad-hoc responses and helps limit damage while reducing recurrence.

include / exclude (matrix)

include adds a specific matrix combination (or attaches values); exclude drops unneeded combinations.

Income statement

A financial statement that matches revenues and expenses over a period to show a company's operating results (profit or loss). It computes profit in stages: gross profit (sales minus cost of sales), operating income (minus SG&A), and ordinary income (adjusted for non-operating gains/losses). Also called the P/L.

Incremental backup

A backup method that copies only data changed since the previous backup (full or incremental). Each run is minimal in size, but restoring requires applying the full backup followed by every incremental in order.

Incremental refresh (semantic model)

On model refresh, loads only recently changed partitions and skips historical data; greatly cuts refresh time and resources.

Independence in fact and independence in appearance

Independence in fact (mental independence) refers to the auditor's inner objectivity — forming judgments free of bias or self-interest. Independence in appearance refers to how the auditor is perceived by third parties: as having no special relationship or conflicting interest with the audited party. Auditing work one personally performed or a system one personally designed should be avoided, since even a fair judgment would damage independence in appearance.

Index

A structure that speeds searching on columns; faster reads but added write-time cost.

Index (CREATE INDEX)

An auxiliary data structure created with CREATE INDEX to speed up lookups. Built on a column or combination of columns, it accelerates filtering in WHERE clauses and JOIN conditions. The default index type is B-tree, and adding indexes increases the write cost of INSERT/UPDATE operations, since the indexes must also be updated.

Index and indexer

The index that defines what is searchable in Azure AI Search and the indexer that pulls content from data sources to populate it. Queries support syntax, sorting, filtering, and wildcards.

Index and statistics maintenance

Reorganizing/rebuilding fragmented indexes and updating statistics on a schedule to keep performance. Typically scheduled via automation (jobs).

Index Only Scan

An execution-plan scan method that returns results using only the columns present in the index, skipping access to the heap (the actual table). The planner can choose it when every column the query needs is covered by the index (a covering index), but whether it actually avoids heap access also depends on the state of the Visibility Map.

Indexing policy and composite index

Cosmos DB indexes all properties by default. The indexing policy specifies included/excluded paths—write-heavy excludes to lower update cost, read-heavy indexes filter paths. A composite index optimizes ORDER BY on multiple properties and multi-filter queries.

Industrial property rights

A collective term for four rights: patent, utility model, design, and trademark rights. Unlike copyright, obtaining these rights requires application to and registration with the patent office.

Inference parameters (temperature/top-p/context window)

Temperature/top-p tune output randomness (low=focused/high=creative); the context window is the max input+output tokens at once.

Inference pipeline (multi-container)

A SageMaker setup chaining preprocessing → inference → postprocessing as multiple containers behind one endpoint, reusing the same transforms at inference as in training.

Inference Recommender

Recommends the optimal instance type, count, and configuration for a model via load testing to optimize inference cost and performance.

Inference types (real-time/batch)

Real-time inference responds per request at low latency; batch inference processes large data asynchronously in bulk. Choose by latency needs and cost.

Information asset

Information that has value to an organization and is subject to risk assessment, together with the systems that handle it. It covers not only the data itself — such as customer records or design documents — but also the equipment (servers, PCs) that stores or processes it, and related business processes. Building an inventory and rating importance (confidentiality, integrity, availability) is the starting point of asset management.

Information Barriers

A Microsoft Purview feature that proactively blocks chat, calls, file sharing, and team search/join between specific departments or groups via policy. Used to technically enforce conflict-of-interest regulations (compliance walls), such as separating research and investment banking divisions at a securities firm. Unlike Communication Compliance, which detects after the fact, this prevents the communication from occurring in the first place.

Information content (entropy)

A measure that quantifies how unlikely an event is. The information content of an event with probability p is -log2 p bits, so rarer (lower-probability) events carry more information. Average information content (entropy) is the expected value of information content weighted by each event's probability, indicating the overall uncertainty of an information source.

Information security

The overall effort to protect information from threats such as leakage, tampering, and loss, keeping it safe to use. Its basis is protecting the three elements (CIA) — confidentiality (only authorized people can use it), integrity (contents stay correct), and availability (usable when needed) — covering not only technical measures like firewalls but also operational ones such as password management and user training.

Information security education and training

An ongoing effort that goes beyond drafting rules and regulations, using periodic group training, e-learning, and targeted-attack email drills to instill security awareness and behavior across all employees. It is central to the effectiveness of personnel-based controls, and keeping records of participation and measuring comprehension are key to preventing the program from becoming a formality.

Information security governance and corporate governance

Corporate governance is the mechanism by which shareholders, the board of directors, and similar bodies oversee management to ensure transparency and soundness in how a company is run. Information security governance is the framework, forming part of corporate governance, through which executives themselves lead policy-setting, resource allocation, and oversight for security. Its defining feature is that management treats security as a business issue to be led from the top, not merely a matter for the IT department.

Information security policy (three-tier structure)

A documented structure of an organization's information security decisions, made up of three tiers: the top-level basic policy (management's philosophy and declaration), the standards that concretize it (rules to be followed), and the procedures that describe day-to-day operational steps. Higher tiers change less frequently; lower tiers are more concrete and updated more often.

Information systems strategy

A top-level policy defining how information systems should be developed and used to realize a company's management and business strategy. It underlies enterprise-wide optimization plans and IT investment prioritization, and individual system projects must align with it.

information_schema

A schema providing access to database metadata (tables, columns, constraints, etc.) in a SQL-standard-compliant form, enabling queries that are not tied to a specific DBMS implementation.

Infrastructure as Code (IaC)

Defining infrastructure declaratively as code (templates) so it is reproducible and version-controlled—preventing manual drift and enabling review, automation, and consistent multi-environment builds. On AWS, CloudFormation and CDK are the main tools.

Infrastructure Manager

A Google Cloud service that runs Terraform as managed IaC, making infrastructure reproducible and reviewable/auditable via CI/CD and PRs.

Inherent risk

The risk inherent to a business process or system by its very nature, assuming no internal controls exist. It stems from factors such as transaction complexity, monetary significance, or technological novelty, and is assessed by the auditor independently of whether controls are in place. Areas with high inherent risk receive a greater share of audit resources.

initdb

The command that initializes a new database cluster: it creates the data directory and builds the initial system catalogs, including the template1 and template0 databases.

initdb --data-checksums

An initdb option that adds checksums to data pages when the cluster is initialized, making storage corruption easier to detect. Toggling it later requires re-initializing the cluster (or the pg_checksums tool). Through PostgreSQL 17 it was disabled by default and enabling it required explicitly passing --data-checksums, but from PostgreSQL 18 onward it is enabled by default; use --no-data-checksums to disable it.

initramfs

An initial RAM disk containing the drivers the kernel needs to mount the real root filesystem; it bridges early boot.

Injection countermeasures (placeholders, sanitizing)

A set of techniques for safely handling input to prevent SQL injection and XSS. A bind mechanism (placeholder) fixes the skeleton of an SQL statement first and then plugs in values as pure data, so input can never be interpreted as SQL commands — a fundamental countermeasure. Sanitizing (escaping) converts special characters such as `<` and `'` into harmless representations so they are not interpreted as commands, and is used as an output-time countermeasure against XSS.

Inline suggestions

Suggests a grayed-out "continuation" from the cursor context; not applied to the code until accepted (confirmed).

Innovation and disruptive innovation

Innovation is the creation of new value through technological or systemic change. Whereas sustaining innovation incrementally improves the performance of existing products, disruptive innovation refers to change that — though initially lower in performance — displaces existing markets and products through new value such as simplicity or low price.

Innovator's dilemma

A phenomenon in which an industry-leading firm, precisely because it listens carefully to its best existing customers and keeps refining sustaining technology, is slow to respond to disruptive technology that initially performs worse but offers new value such as low cost or simplicity, and as a result loses its market to that disruptive technology. Strategists use this paradox, in which sound, rational decisions about the existing business end up blinding the firm to a future threat, to judge whether disruptive technology needs to be nurtured in a separate unit outside the core business.

inode

The metadata record managing a file (size, owner, permissions, data location); a filename is just a label on an inode. ls -i shows inode numbers—matching numbers mean hard links.

Input reformatting (preprocessing)

Preprocessing that reshapes vague or messy user input into a form generative AI handles well—rephrasing/clarifying via Bedrock and normalizing/detecting language via Comprehend—improving retrieval accuracy and answer quality.

Input/output bindings (Functions)

Declaratively connect a function to data sources; input bindings read and output bindings write without boilerplate code.

Input/output devices

A collective term for devices that input data into a computer (keyboard, mouse, scanner, etc.) and devices that output the results of processing (display, printer, etc.). In IoT devices, sensors act as input devices and actuators as output devices.

inputs (workflow inputs)

Parameters received via workflow_dispatch or workflow_call; define type (string/boolean/choice/number/environment), required, default, options, and read via inputs.<name>.

Insider risk management

Detects and manages risks of leaks or malicious activity by insiders from behavioral signals (privacy-conscious).

Insider threat

Deliberate misconduct by someone inside the organization — an employee or contractor — who abuses legitimate access to exfiltrate or tamper with information or disrupt systems. It is harder to detect than external attacks and is often explained by the fraud triangle: motive (grievance, money), opportunity (excessive privilege), and rationalization. Access-log monitoring and separation of duties are the main countermeasures.

Instance metadata (IMDSv2)

A scheme requiring a session token (PUT→GET) to access EC2 instance metadata, preventing SSRF-based theft of the instance role’s temporary credentials. The recommendation is to disable IMDSv1 and enforce IMDSv2.

Instance Metadata Service (IMDS)

An endpoint at 169.254.169.254 that lets an EC2 instance read its own data (instance ID, the IAM role’s temporary credentials, user data, etc.). IMDSv2 requires a session token to prevent credential theft via SSRF (enforcing it is recommended).

Instance profile (IAM role for EC2)

A container that passes an IAM role to EC2: instead of embedding access keys, the instance fetches auto-rotating temporary credentials via instance metadata (lower leak risk). IMDSv2 is recommended.

Instance refresh

Rolls an Auto Scaling group’s instances to a new launch template/AMI in batches, replacing them gradually while keeping a minimum healthy percentage—enabling immutable deployments.

Instance store

Temporary storage physically attached to the host: very fast but ephemeral—data is lost on stop/terminate. Suited for caches/scratch; use EBS when persistence is needed (a common SOA contrast).

Instant cloud flow

A cloud flow started manually (e.g., a button press); run on demand from an app or mobile button.

Instruction cycle (fetch/decode/execute/store)

The basic repeating cycle by which a CPU processes one machine-language instruction: fetch (retrieve the instruction from main memory) → decode (interpret it) → execute (perform the operation) → store (write the result back to a register or main memory). Overlapping these stages across multiple instructions is what pipeline processing does.

Instruction pipeline hazard

A disruption in instruction pipelining (a stall or flush) caused when a branch instruction or a data dependency prevents a subsequent instruction from executing correctly. Hazards are classified as structural, data, or control (branch) hazards. In embedded systems they threaten real-time determinism, so branch prediction and instruction reordering are important mitigations.

Instructions files

A standing config file that supplies coding conventions and review standards so Copilot reviews/responds with consistent criteria.

Instrumentation (App Insights)

Adding the SDK or auto-instrumentation so an app emits telemetry; a connection string sets the destination, and custom events can be added.

Integrated cache

A Cosmos DB feature that, via a dedicated gateway, caches point reads and query results to greatly reduce RU for very read-heavy, slowly-changing workloads (accepting eventual freshness). Different in role from indexing (query efficiency).

Integrated change control

The process of receiving change requests, assessing their impact on scope, schedule, cost, and quality, and having a change control board approve, reject, or defer them before updating baselines. It prevents uncontrolled changes (scope creep) and keeps change impact managed consistently across the project.

Integrity checks (DBCC CHECKDB)

A command that checks a database for logical and physical corruption. Run regularly to detect corruption early and, with backups, ensure data integrity.

Intellectual property rights

A collective term for rights that protect creative outcomes such as inventions, works of authorship, designs, and trademarks. It is broadly divided into copyright and industrial property rights (patent, utility model, design, and trademark rights).

Intelligent Insights

An Azure SQL feature that automatically detects performance problems and emits root causes and recommendations as diagnostic logs.

Intelligent query processing (IQP)

A set of features that improve query performance without rewrites (adaptive joins, memory-grant feedback, batch mode, etc.), enabled via compatibility level.

Inter-VLAN Routing

Because different VLANs are separate broadcast domains, layer-3 routing is required for hosts in one VLAN to reach another, a process called inter-VLAN routing. Two common implementations are router-on-a-stick, using per-VLAN subinterfaces over a single trunk link to an external router, and a layer-3 switch with per-VLAN SVIs (switch virtual interfaces) performing the routing internally.

Internal audit and external audit

Internal audit is performed by an audit function inside the organization, which secures objectivity through direct reporting to management and organizational independence of the audit unit. External audit is performed by a third party outside the organization, such as an audit firm or outside specialist, whose independence is more readily assured by having no vested interest in the organization. The two differ in purpose and in how independence is secured, and are often used to complement each other.

Internal control

The mechanisms and structures a company builds into its own business processes so that operations are carried out appropriately and efficiently. Its objectives are (1) effectiveness and efficiency of operations, (2) reliability of (financial) reporting, (3) compliance with laws and regulations relevant to business activities, and (4) safeguarding of assets, and it comprises six basic elements: control environment, risk assessment and response, control activities, information and communication, monitoring, and response to IT (FSA implementation standards / COSO framework). Responsibility for establishing and operating it rests with management.

Internet gateway (IGW)

A horizontally scaled, redundant VPC component that enables communication between a VPC and the internet. When a public subnet’s route table points to the IGW and resources have public IPs, two-way internet communication is possible. For outbound-only, use a NAT gateway (IPv4) or an egress-only internet gateway (IPv6).

Internet VPN

A VPN built over the shared public Internet using IPsec or SSL/TLS tunnels for encryption and authentication, emulating a private line virtually. It is far cheaper than closed networks or wide-area Ethernet but offers only best-effort bandwidth and latency with no QoS guarantee.

Interrupt latency

The time between an interrupt request occurring and the corresponding interrupt service routine (ISR) actually beginning execution. It depends on the length of interrupt-disabled sections and the priority design of nested interrupts. Real-time systems must estimate the worst-case value of this latency to verify that deadlines can be met.

Interrupt Service Routine (ISR)

A dedicated handler routine invoked by hardware when an interrupt occurs. Standard design practice keeps its execution time to a minimum for responsiveness, deferring any lengthy processing to a regular task. Calling a non-reentrant function or performing long operations inside an ISR degrades the responsiveness of other interrupts and tasks.

Intersight and the Webex API

Intersight is Cisco's SaaS platform for centrally managing and automating compute infrastructure (such as UCS) from the cloud, exposing a REST API to fetch state and drive operations. The Webex API lets code send messages, create meetings, and more; CUCM's AXL/UDS interfaces are the APIs used to manage and look up an on-premises call platform.

Interview method

An audit technique in which the auditor questions personnel or managers in the audited department to gather information and evidence about actual operations or system practices. It provides direct explanations from those involved, but statements alone carry limited evidential weight and must be corroborated with other procedures such as record review or on-site observation.

Inventory management

Management to maintain an appropriate inventory level, curbing both lost sales from stockouts and holding costs from excess stock. It uses methods such as the reorder-point system, which orders when stock falls to a set level, and the economic order quantity (EOQ), which finds the order size that minimizes the sum of per-order and holding costs.

Inventory valuation

Calculating the monetary value of remaining inventory (stock) at closing. Because purchase prices vary, methods such as FIFO (first-in first-out) and moving average differ in which unit cost they apply, and the choice affects reported profit.

Investigation package

A Defender for Endpoint feature that bulk-collects forensic data from a device (running processes, network connections, registry, autoruns, logs, etc.). Unlike the interactive shell of live response, it non-interactively gathers a fixed set of items in one pass for investigation.

Investigation tool

A tool that searches logs across data for security incidents (e.g., phishing spread) and takes bulk actions such as bulk-deleting messages or addressing devices; confirm scope before running powerful bulk actions.

IoC (indicator of compromise) and IoA (indicator of attack)

An IoC (indicator of compromise) is after-the-fact evidence that a breach has already happened — a suspicious file hash, a callback IP, a filename. An IoA (indicator of attack) is a sign that an attack is still in progress, such as an anomalous process chain; where IoCs are mainly used for after-the-fact response, IoAs are used for real-time detection and blocking.

IoT (Internet of Things)

A mechanism in which various "things" — home appliances, equipment, vehicles, and more — equipped with sensors connect to the internet and exchange information with each other. Analyzing and utilizing the collected data is the source of its value.

IoT vulnerability

Weaknesses characteristic of IoT devices: they are often left on default passwords, firmware updates may not be provided or applied, and limited processing power leads to minimal security features — all of which make them easy to compromise, frequently for recruitment into botnets.

IP address (IPv4 / IPv6)

A number identifying a host on a network: IPv4 is 32 bits in dotted quads (192.168.1.10), IPv6 is 128 bits in colon-hex, structurally solving address exhaustion; an fe80:: link-local address auto-configures for on-link traffic.

IP address (networking basics)

A number that identifies a device on a network (under NAT, private IPs may be reused across different organizations). There are global IP addresses used directly on the internet and private IP addresses used within a limited scope such as an organization.

IP allow list

An org setting accepting access only from approved IP ranges; since GitHub-hosted source IPs vary, combine with larger runners’ static IPs or self-hosted for fixed IPs.

IP forwarding

A kernel setting that lets a server relay (route) packets not addressed to itself out through another network interface. It is toggled via /proc/sys/net/ipv4/ip_forward or the sysctl parameter net.ipv4.ip_forward, and is required to make a Linux server act as a router.

IP masquerade (GKE)

A mechanism that source-NATs a GKE Pod's outbound (egress) traffic to the node's IP. By default, non-masqueraded (untranslated) destinations are RFC 1918 private ranges and link-local addresses; the ip-masq-agent configuration lets you add or change the target CIDRs. Whether this agent is auto-deployed as a DaemonSet, and its default configuration, depends on the GKE version and cluster setup (e.g., Autopilot vs. Standard, whether Dataplane V2 is in use).

IP phone

A telephone that carries voice as IP packets over the network instead of a traditional phone line, using VoIP technology; most receive power over the same LAN cable via PoE.

IP SLA

A feature that actively measures performance such as reachability, delay, and jitter by sending synthetic (generated) test traffic, rather than relying on real business traffic. Linking its results to a track object enables active fault response, such as automatically switching to a floating static route the moment a path's performance degrades or it becomes unreachable.

ipconfig and tracert

Basic Windows network diagnostic commands. ipconfig displays and refreshes a machine's own IP configuration (/all for detail, /release and /renew to re-acquire a DHCP lease), and tracert shows each router hop on the path to a destination (the Windows equivalent of traceroute on Linux/macOS).

iperf and speed test

Tools for measuring actual network performance. A speed test easily measures speed to a specific server from a browser, while iperf is an open-source tool that measures throughput in detail between two points you control (a client and a server), useful for isolating problems.

IPsec

A protocol suite that encrypts and authenticates traffic at the IP packet level, used to encrypt the path in site-to-site VPNs (on-prem to a cloud VNet/VPC). The tunnel won't establish unless both ends agree on encryption, integrity, and key-exchange settings.

IPsec transport mode and tunnel mode

IPsec encapsulation forms. Transport mode preserves the original IP header and protects only the payload, so it is mainly used for host-to-host communication. Tunnel mode wraps the entire original IP packet (including its header) inside a new IP header, so it is used for site-to-site VPNs (gateway-to-gateway) and also hides the original addresses in transit.

iptables / firewalld (firewall)

A host packet filter: iptables drives the kernel netfilter directly via rule chains (INPUT/OUTPUT/FORWARD); firewalld manages by zones and service names (rules vanish on reboot without --permanent). The policy is default-deny, allowing only what is needed.

IPv4 Address

A 32-bit Internet-layer address consisting of a network portion and a host portion, with the boundary expressed via subnet mask or CIDR notation (e.g., /24). Address exhaustion has driven widespread use of NAPT and IPv6 coexistence. Frequently tested as the basis for subnetting and CIDR aggregation calculations.

IPv6 Address

A 128-bit Internet-layer address written as eight 16-bit hexadecimal fields separated by colons, where a single run of consecutive zero fields may be abbreviated once with '::'. Its prefix length denotes the network portion, with the interface identifier typically occupying the lower 64 bits — a structural contrast to IPv4 subnet masking.

IRR (Internal Rate of Return)

The discount rate at which a project net present value (NPV) becomes exactly zero, representing the effective rate of return the investment generates. If the IRR exceeds the cost of capital (required rate of return), the investment is judged worthwhile, and among competing proposals a higher IRR is generally considered more favorable. Care is needed because certain cash-flow patterns can yield multiple solutions, and IRR does not directly reflect differences in investment scale.

IsBlank function (Power Fx)

Tests whether a value is blank; used for required-field checks and default handling (distinct from an empty string).

IServiceEndpointNotificationService

A service to publish Dataverse events to a service endpoint (webhook/Azure Service Bus/Azure Event Hub).

ISMS (Information Security Management System)

A systematic management framework an organization operates to appropriately protect its information assets, spanning policy formulation, risk assessment, implementing countermeasures, and review (PDCA). A certification scheme based on the international standard ISO/IEC 27001 exists.

ISMS Conformity Assessment Scheme

A Japanese scheme under which an accredited third-party certification body audits and certifies whether an organization's ISMS conforms to the requirements of ISO/IEC 27001. Obtaining certification serves as objective proof of trustworthiness to business partners and customers.

ISO 26262

An international functional-safety standard specific to automotive electrical/electronic systems. Derived from IEC 61508 for the automotive domain, it determines an Automotive Safety Integrity Level (ASIL) A through D based on severity, exposure, and controllability of a hazard, and specifies the development process and verification methods required at each level. ASIL D is the most stringent level.

ISO image

An image format packing an optical disc into a single file; distributed as Linux install media, written to DVD/USB or mounted directly by a VM to boot.

Isolation

One of the ACID properties, ensuring that concurrently executed transactions produce results as if each ran independently without interference from others. The isolation level setting controls how much anomalous behavior, such as dirty reads, is permitted.

Isolation levels (READ COMMITTED/REPEATABLE READ/SERIALIZABLE)

A setting that determines how much of other transactions' changes are visible to a concurrent transaction. Standard SQL defines four levels (READ UNCOMMITTED, with dirty reads of uncommitted data allowed; READ COMMITTED; REPEATABLE READ; and SERIALIZABLE), but PostgreSQL treats READ UNCOMMITTED the same as READ COMMITTED, leaving effectively three levels. READ COMMITTED (PostgreSQL's default) sees only committed data but can suffer non-repeatable reads; REPEATABLE READ holds a snapshot from transaction start, preventing not only non-repeatable reads but also phantom reads (a PostgreSQL-specific behavior); SERIALIZABLE is the strictest level, guaranteeing consistency equivalent to serial execution.

Issue

Tracks and discusses bugs/requests/tasks one at a time; integrates with Labels/Assignees/Milestones.

Issue templates

A predefined form shown when creating a new issue. Beyond the older Markdown-based format, YAML-defined issue forms add structured inputs (text fields, dropdowns, checkboxes), letting you require fields and auto-apply labels to standardize submissions. Stored under `.github/ISSUE_TEMPLATE/`.

IT control

The mechanisms that support internal control from the information-systems side, using IT to manage and control operations so they are performed correctly and safely. It consists of system-wide controls such as access-rights management and change management, and controls that safeguard the accuracy of individual business processing, such as input checks and reconciliation.

IT general controls and IT application controls

Among IT controls, IT general controls cover system-wide foundations such as access management, change management, and operations management, while IT application controls ensure the accuracy of input, processing, and output within individual business systems (input checks, reconciliation, approvals). If IT general controls are not effective, the reliability of individual IT application controls is also undermined.

IT investment portfolio

A management approach that classifies multiple IT investment proposals by criteria such as strategic fit, risk, and expected return, and optimizes the combination of projects within a limited budget. A key point is not comparing dissimilar investments, such as those essential to keep core operations running versus offensive investments aimed at creating new business, on the same single evaluation axis. IT strategists take a bird's-eye view of competing investment requests from business units and prioritize them by weighing their contribution to management strategy against their risk.

IT service continuity management (ITSCM)

ITSCM (IT service continuity management) develops, maintains, and rehearses continuity plans so that, even in events such as disasters or major failures, services can be recovered within the agreed RTO (recovery time objective) and RPO (recovery point objective); it forms part of business continuity planning (BCP). Recovery means, alternative facilities, and priority recovery order are defined in advance, and the plan's effectiveness is verified through periodic exercises. The IT service manager sets recovery objectives from business impact analysis and judges the balance between investment and recovery speed.

Item permissions (Fabric)

Shares/grants access to individual items (lakehouse/report) to specific users, separate from workspace roles.

Iterative least-privilege tightening

An operating cycle that starts broad, then continuously removes unneeded permissions based on Access Analyzer’s unused access, actual usage in CloudTrail, and Access Advisor’s last-accessed data—tightening safely with generated policies.

Iterator functions (SUMX, etc.)

DAX functions that evaluate a table row by row and aggregate (SUMX, AVERAGEX, MAXX); used to total per-row calculations.

ITF (integrated test facility)

A CAAT technique in which a fictitious audit entity (a dummy department, business partner, or account) is established within the production environment, and auditor-prepared verification data is processed alongside real production transactions, with the results then examined. It allows continuous verification of processing accuracy in parallel with live operations, but requires safeguards to prevent contamination of actual production data.

ITIL

A framework summarizing best practices in IT service management, systematizing approaches such as incident management and change management. The latest edition, ITIL 4 (2019), is reorganized around the value-co-creation-centric Service Value System (SVS) and 34 practices (the former processes are carried forward as practices).

J-SOX (internal control reporting system)

A system under Japan's Financial Instruments and Exchange Act requiring listed companies' management to self-assess the effectiveness of internal control over financial reporting, prepare an internal control report, and undergo audit by a certified public accountant. Management scopes the assessment using a top-down risk approach, prioritizing items of high financial materiality; auditors verify the validity of management's assessment.

Jackson method (JSP)

A program design technique (Jackson Structured Programming) that derives program structure from the input and output data structures. Data is modeled with the three basic constructs of sequence, selection, and iteration, and the program's control structure is mapped mechanically from the input/output data structures. It rests on the idea that data structure dictates process structure, which helps a system architect assure structural correctness.

Jailbreak detection

Detecting and blocking inputs that try to bypass the system prompt’s constraints (jailbreaks), using classifiers, pattern detection, Guardrails, and adversarial testing (red-teaming). A primary generative-AI risk alongside prompt injection.

JIS Q 20000 and the service management system (SMS)

A service management system (SMS) is the structured framework of service management policies, objectives, plans, and processes, operated and improved through the PDCA cycle. JIS Q 20000-1 specifies the requirements for an SMS and serves as the basis for third-party certification. Unlike ITIL, which is a body of best practice, JIS Q 20000 is a set of requirements to be met, and a service manager applies each according to purpose.

JIS Q 21500

A Japanese Industrial Standard providing guidance on project management (JIS Q 21500:2018, aligned with ISO 21500:2012). It structures practice into five process groups (initiating, planning, implementing, controlling, closing) and ten subject groups (knowledge areas), and serves as the basis of the PM exam Part-A-II syllabus structure. Note that ISO 21500 was reorganized in 2021 into a governance standard with process details moved to ISO 21502, while the IPA exam follows the traditional process-group/subject-group framework.

JIT (Just-In-Time production)

A production-control method of making or procuring only what is needed, when it is needed, in the amount needed. Aimed at raising efficiency by eliminating excess inventory and work-in-process, it is typically realized through the kanban method, in which a downstream process withdraws only what it needs from the upstream process.

Jitter and jitter buffer

Jitter is the variation in packet inter-arrival times (delay variation). Even with acceptable average delay, high jitter causes voice/video to stutter. Placing a jitter buffer (de-jitter buffer) on the receiver, which buffers arriving packets briefly before playing them out at a steady rate, absorbs the variation for smooth playback.

Job

A unit of execution in a workflow; selects a runner via runs-on and runs a sequence of steps. Jobs run in parallel by default, each in an isolated environment.

Job bookmarks

A Glue feature that remembers processed data position to incrementally process only new data on reruns, preventing duplicates.

Job control (bg / fg / jobs)

Running commands in the foreground/background from the shell: trailing & backgrounds, Ctrl+Z suspends, bg resumes in the background, fg brings to the foreground, jobs lists them.

Job outputs

Maps step outputs to a job’s outputs so dependent jobs read needs.<job>.outputs.<name>; passes short values to another job.

JOIN (INNER/LEFT/RIGHT/FULL/CROSS)

The clause for querying across multiple tables. INNER JOIN returns only rows matching in both tables; LEFT JOIN returns all left-table rows plus matches from the right; RIGHT JOIN is the reverse; FULL JOIN returns all rows from both tables regardless of a match; CROSS JOIN returns the unconditional Cartesian product.

Join meeting issues

Failures where sign-in succeeds but a user cannot join a meeting, or features (audio, video, screen share, etc.) fail after joining. Root causes lie in the meeting/client layer—lobby wait settings, meeting policies, or network/client issues. Diagnosed via CQD or Teams client logs.

Join strategies (Nested Loop / Hash Join / Merge Join)

The main join methods the planner chooses among. Nested Loop efficiently probes the inner side (e.g., via an index) for each of a small number of outer rows, favoring small joins. Hash Join is for equality joins only, building a hash table on one side to avoid a full cross-comparison. Merge Join merges both sides assuming they are already sorted (or cheaply sortable). Index availability and sortedness are the key factors in the choice.

Journaling

A mechanism that records write operations before performing them, keeping the filesystem consistent through power loss; provided by ext3/ext4/XFS.

JPCERT/CC

A general incorporated association that accepts incident reports, supports response, and issues alerts for computer security incidents in Japan. As a neutral coordinating body independent of any specific government agency or company, it also serves as a hub for information sharing among CSIRTs at home and abroad.

JPEG and MPEG

JPEG is a representative image format that lossily compresses still images such as photographs. MPEG is a representative family of standards for compressing video (image plus audio), reducing data volume by exploiting differences between frames.

JSON

A lightweight text format representing structured data as braces and key–value pairs. Widely used wherever machine-readability matters most—API request/response bodies and permission definitions like IAM or bucket policies.

JTAG / ICE (In-Circuit Emulator)

JTAG is a standard debug serial interface specification for accessing a chip's internal registers and memory from outside. An ICE (in-circuit emulator) is a debugging tool that emulates or controls the target CPU while enabling breakpoints and memory/register read-write on real hardware, typically connecting via JTAG. It is indispensable for firmware verification on real hardware where a source-level software debugger alone cannot reach.

Just-In-Time (JIT) VM access

A Defender for Cloud feature that keeps VM management ports (RDP/SSH) closed by default and, only on request/approval, inserts a temporary allow rule into the NSG/Firewall, auto-closing it after a window. It avoids standing exposure to reduce the attack surface. Unlike Bastion (an always-available jump host), JIT opens access only when needed.

JVN (Japan Vulnerability Notes)

A portal jointly operated by JPCERT/CC and IPA that publishes vulnerability information and countermeasures for software used in Japan. Entries note the corresponding CVE ID and severity (CVSS) and serve as a primary reference for vulnerability response.

k-means clustering

A classic unsupervised method that partitions data into k clusters by iterating assign-to-nearest-centroid then update-centroids. Choose k via the elbow method/silhouette; sensitive to scale, so standardize first. Used for customer segmentation, etc.

Kanban method

A development/production management method that visualizes work items as cards moving through columns such as 'to do,' 'in progress,' and 'done,' capping the number of items per column (WIP limits) to manage flow. Unlike Scrum, it does not require fixed timeboxes (sprints); instead, completed items are pulled to the next stage continuously.

Karnaugh map

A grid-based layout of a logic function's truth table, arranged so that adjacent cells differ in exactly one input bit, allowing terms to be grouped visually and the logic expression minimized to its simplest form. It is used in embedded hardware description and control-logic design to reduce gate count for smaller, lower-power circuits.

Kerberos authentication

A ticket-based authentication protocol using tickets issued by a Key Distribution Center (KDC). After a single authentication to obtain a ticket, the user simply presents the ticket to each service, enabling single-sign-on-style use without sending a password to each service.

Kernel

The core of the OS; it manages hardware (CPU, memory, devices) and provides services to processes. VMs each have their own kernel, while containers share the host kernel.

Kernel modules (modprobe)

A way to load drivers into the kernel only when needed: lsmod lists loaded modules, modprobe loads/unloads with dependencies (the first choice), and insmod/rmmod load/unload a single module by file path.

Key distribution problem

The problem that, in symmetric-key cryptography, both parties must securely share the same key, but a separate secure means is needed to deliver that key itself. This is solved by hybrid schemes that use public-key cryptography to encrypt and deliver the symmetric (session) key, or by Diffie-Hellman key exchange, which lets both parties derive the shared key without ever sending the key itself over the wire.

Key hyperparameters

Settings that control training: learning rate (step size), batch size, epochs, tree depth, and regularization strength—tuned to balance convergence and generalization.

Key influencers

An AI visual that auto-analyzes and shows the factors most affecting an outcome (e.g., churn). Different in purpose from the decomposition tree (decompose by dimension).

Key management lifecycle (generation, storage, rotation, destruction)

The set of processes for safely operating cryptographic keys: (1) generation—creating a key of sufficient strength by a secure method; (2) storage—safeguarding keys (e.g., in an HSM) to prevent private-key leakage; (3) rotation—periodically renewing keys to limit the damage scope if one is compromised; and (4) destruction—securely deleting unneeded keys so they cannot be recovered. Because a leaked private key undermines the trustworthiness of everything encrypted or signed with it, the storage stage requires particularly strong controls.

Key phrase extraction and language detection

Extracts the main key phrases from text and detects which language it is with a confidence score.

Key rotation and backup

Periodically auto-rotates Key Vault keys/secrets/certificates to reduce leak risk, and uses backup/restore to guard against accidental deletion or failure.

Key Vault objects (keys/secrets/certificates, dev)

Securely fetching and using secrets, keys, and certificates from code; avoid hard-coding (e.g., connection strings)—use Key Vault references or managed identity.

Key-value store (KVS)

A simple NoSQL data model that manages data purely as key-value pairs. Being schemaless, it scales out easily and suits use cases like session management or caching, where reads/writes are simple and speed matters.

KGI and KPI

KGI (Key Goal Indicator) is the ultimate numerical business target to be achieved, while KPI (Key Performance Indicator) is an intermediate metric that tracks progress toward that KGI. Continuously measuring KPIs helps manage progress toward the KGI.

Kinesis consumers (enhanced fan-out / KCL)

The read side of Kinesis Data Streams. Standard consumers share a shard’s throughput; enhanced fan-out gives each consumer a dedicated 2 MB/s for low latency; the KCL (Kinesis Client Library) handles checkpointing and load balancing.

Kinesis Data Streams

Durable streaming ingestion. It retains data for replay, parallelizes via shards, and lets multiple custom consumers read the same stream.

Kiro

An "agentic IDE" from AWS that drives design, implementation, and testing from a spec via AI agents, supporting generative-AI-assisted software development.

KMS encryption context

Additional key/value pairs supplied at encryption; requiring the same context at decryption binds “decrypt only in the right context,” and it’s logged in CloudTrail for auditability. S3, Secrets Manager, etc. use it internally.

KMS key policies and grants

Access to a KMS key is controlled by the key policy (resource-based, the ultimate source of permission), combined with IAM policies and grants (temporary, programmatic delegation). Multi-Region keys replicate across Regions.

KMS key types and rotation

KMS key categories: AWS-managed keys (service-managed, auto annual rotation), customer-managed keys (you control policy/rotation/disable), and AWS-owned keys (invisible). Grants and key policies authorize use; automatic key rotation refreshes key material.

Knowledge and generative answers

Providing internal docs or websites as knowledge so generative AI answers naturally without hand-built topics (generative answers).

Knowledge Bases multi-source

Integrating multiple sources (S3, web crawler, databases, etc.) into one knowledge base for cross-source retrieval—tagging metadata per source for filtering and access control, and handling differently-sourced evidence consistently.

Knowledge cutoff

The limit that an LLM only knows up to its training time; it may not know later library spec changes—verify against current docs.

Knowledge management (SKMS)

The process that systematically accumulates and shares knowledge such as known errors, procedures, and FAQs to raise the efficiency and quality of support. The information base underpinning this is the Service Knowledge Management System (SKMS), which delivers the right information to the right staff at the right time, aiming to improve reproducibility of decisions and first-contact resolution. The SKMS is the top-level knowledge base (based on the DIKW model) that encompasses the CMS (configuration management system) and CMDB, while known errors themselves are held mainly in the KEDB (known error database).

Knowledge store (projections)

Stores enrichment output as file, object, and table projections so results can be reused for analytics beyond search.

Known error (KEDB)

A problem whose root cause or workaround has been identified is called a known error, and the repository accumulating them is the Known Error Database (KEDB). By consulting the KEDB, the service desk and technical teams can immediately apply workarounds to known faults, supporting fast incident recovery.

KQL (Kusto Query Language)

A read-only query language for fast search/aggregation over log/time-series data; used with Eventhouse/KQL databases.

KQL jobs (Data lake)

A mechanism to run large-scale KQL queries in batch (not interactively) over big data in the Data lake tier and store the results—used for broad, low-cost exploration on Data lake.

kubectl

The standard CLI to operate Kubernetes/GKE clusters, managing resources like Pods and Services.

KVM

Virtualization built into the Linux kernel (Kernel-based Virtual Machine), turning Linux itself into a hypervisor.

Label (control)

A basic control that displays text or numbers (values or descriptions); it does not accept input.

Labels (GitHub)

A tagging feature attached to issues and pull requests to classify by type, priority, or status. Colors and descriptions are freely defined, and labels can be filtered with the label: search qualifier or used as Actions trigger conditions. Repos/orgs ship with default labels (bug, enhancement, etc.).

Lakehouse (Fabric)

A Fabric item holding files and tables together; processed via Spark/notebooks, with an auto-generated read-only SQL analytics endpoint for T-SQL queries.

Lambda concurrency (provisioned/reserved)

Lambda concurrency controls. Provisioned concurrency keeps environments warm to reduce cold starts; reserved concurrency caps/guarantees a function’s concurrency. Increasing memory also raises CPU proportionally.

Lambda configuration (layers, env vars, ephemeral storage)

Share common libraries via layers and pass settings via environment variables (KMS-encryptable). The /tmp ephemeral storage scales up to 10GB, and the memory setting also determines CPU allocation.

Lambda invocation models (sync/async/stream)

Synchronous waits for the result (e.g., API Gateway); asynchronous queues and runs later, retrying automatically with a dead-letter queue/Destinations on failure; stream/poll uses event source mappings (SQS/Kinesis). Failure handling differs by model.

Lambda MCP server

A server implementation that exposes MCP (Model Context Protocol) tools on AWS Lambda—serving lightweight, stateless tools (search, compute, API calls) serverlessly so agents can call them in a standard form; scales with demand and is cost-efficient.

Lambda runtime config (memory/timeout//tmp)

Memory allocation (128 MB–10 GB; more memory also adds CPU proportionally—sometimes faster and cheaper), timeout (up to 15 minutes), and ephemeral /tmp (up to 10 GB). Tuning these drives performance and cost.

Lambda versions and aliases

Published versions are immutable, and an alias is a mutable pointer to a specific version. Weighted routing on an alias enables canary/linear traffic shifting.

LAN, WAN, and PAN

Networks are classified by scale: a LAN (local area network) covers a limited area such as a home or office, a WAN (wide area network) connects geographically separated sites, and a PAN (personal area network) covers a few meters around a person, as with Bluetooth.

Large language model (LLM)

A model trained on vast text that generates language by predicting the next token (Transformer-based).

Large semantic model storage format

A storage format for large models; raises size limits and enables XMLA write and some advanced features.

Larger runners

GitHub-hosted runners with more CPU/memory or static IP ranges; used for fixed-IP needs or heavy jobs.

Launch template

A versioned definition bundling launch settings (AMI, instance type, user data, networking) used by Auto Scaling and Spot; the older launch configuration is legacy.

Layer 2 Loop

A layer 2 loop is a forwarding loop that arises when switches are interconnected via redundant paths without an active loop-prevention mechanism such as STP. Because layer 2 frames have no TTL, broadcast frames circulate and multiply endlessly around the loop, causing a broadcast storm and MAC address table instability that can disable the entire network.

Layer 2 Switch

An L2 switch forwards frames at the data-link layer based on MAC addresses, relaying frames on a per-port basis by learning and consulting its MAC address table. It does not handle IP addressing or routing, so it is limited to forwarding within the same network (subnet/VLAN); communication between different networks requires an L3 switch or router. It is also the unit at which VLANs and STP are implemented.

Layer 3 Switch

An L3 switch integrates network-layer routing functions with the fast physical/data-link-layer switching of an L2 switch, performing tasks such as inter-VLAN routing in hardware (ASIC) rather than relying primarily on software-based routing as a conventional router does. Because it can both create VLANs and route between them in a single device, it is widely deployed as the core switch in large-scale LANs.

Layered architecture

A structural pattern that divides software responsibilities into layers, where an upper layer depends in principle only on the layer directly beneath it. Separating concerns improves maintainability, replaceability, and testability, so swapping one layer's implementation seldom ripples to others. A presentation / business-logic / data-access three-layer split is typical; note this logical layering differs conceptually from the physical three-tier client-server deployment.

Layered defense (entry, internal, and exit controls)

A design philosophy premised on the idea that intrusion can never be prevented with 100% certainty, combining entry controls (firewalls/WAF to block intrusion itself), internal controls (privilege management and EDR to contain damage after intrusion), and exit controls (DLP and proxies to stop data exfiltration) in multiple layers, avoiding over-reliance on any single measure.

Lead / lag

Lead is the amount of time a successor activity can be advanced ahead of its logical relationship (a negative offset), while lag is a deliberate waiting time that delays the start of a successor (a positive offset). Both are used for realistic schedule adjustments, and mixing up the sign leads to incorrect duration calculations.

Lean startup and MVP

Lean startup is a method for developing new businesses in which unvalidated hypotheses about a business idea are tested by quickly building a Minimum Viable Product (MVP), a product with just enough features to be usable, putting it in front of customers, and learning from the result through a build-measure-learn cycle, then deciding whether to pivot or persevere. Strategists apply it when judging that, for a new business with uncertain demand, cheap hypothesis testing via an MVP should take priority over a detailed up-front business plan.

Ledger in Azure SQL

A tamper-evident ledger feature. Cryptographically linked digests make history verifiable, offering updatable and append-only ledger tables.

Legacy service management (inetd / xinetd / chkconfig)

Pre-systemd service management: inetd/xinetd are super-servers that spawn services on demand (config in /etc/xinetd.d/); chkconfig/service are the legacy RHEL autostart and start/stop tools. Stopping unused services shrinks the attack surface.

Library and API

A library is a reusable set of components (functions and classes) that bundle commonly used functionality, invoked rather than written from scratch. An API (application programming interface) is the agreed-upon specification — how to call it — that lets you use the functionality of such a library or external service without knowing its internal implementation.

LICENSE

A file stating terms for use/modify/redistribute; a public repo with none defaults to all rights reserved.

License (seat)

A per-user allocation. Monitor license usage and reclaim unused seats; with SCIM/EMU, departed users’ seats free up automatically.

License assignment (direct / group-based)

Access to Microsoft 365 and Copilot features depends on license type, assigned directly to users or in bulk via group-based licensing. Copilot needs a separate license on top of existing M365 licenses.

License management (assignment, billing, optimization)

Managing licenses end to end: assigning purchased licenses to users, billing per user monthly/annually, and reviewing usage to reclaim unused seats (optimization). Add-ons extend features.

Lifecycle rules

Cloud Storage rules to automate "delete after N days" or "move to a cheaper class after N days," optimizing cost; in BigQuery, expiration plays a similar role.

Lightweight AP

An access point that holds no configuration of its own and instead operates under constant control and configuration delivered from a WLC over a CAPWAP tunnel. Only an IP address needs to be set on the AP itself, making it suited to large-scale, centrally managed multi-site deployments. It contrasts with an autonomous AP.

Line Coding

Line coding is the scheme for converting a digital bit stream into an electrical or optical waveform suitable for transmission over a physical medium, with examples including Manchester encoding, NRZ, 4B/5B, and 8B/10B. Key selection criteria include ease of clock recovery at the receiver, suppression of DC bias, and coding efficiency, and different Ethernet standards (e.g., 10BASE-T, 1000BASE-T) adopt different line coding schemes.

Linear programming

A mathematical optimization method that finds the solution maximizing or minimizing an objective function (a linear expression such as profit or cost) subject to multiple constraints expressed as linear inequalities. Used for production planning and resource allocation problems; it exploits the property that the optimal solution occurs at a vertex of the feasible region.

Linear regression

A foundational supervised-learning model that predicts a continuous target as a weighted linear combination of features. It's easy to interpret and is often the first baseline tried for a regression problem.

Linear search

A search method that examines elements one by one from the beginning of an array or list until the target value is found. It works on unsorted data, but has O(n) time complexity, making it slower than binary search.

Link aggregation (LACP)

A technique that logically bundles multiple physical links into one high-bandwidth logical link, using all links for data transfer simultaneously (IEEE 802.3ad, controlled by LACP). It aggregates bandwidth and also provides redundancy since remaining links carry traffic if one fails — unlike STP redundancy, which keeps one link on standby.

Link-Local Address

An IPv6 address valid only within a single link, drawn from the fe80::/10 range. It is never forwarded across routers and is automatically assigned to every interface, distinguishing it from a global unicast address. It underlies link-local control traffic such as Neighbor Discovery Protocol exchanges.

LISP (Locator/ID Separation Protocol)

A protocol used as SD-Access's control plane. It separates a device's identity (the EID, or endpoint identifier) from its location (the RLOC, or routing locator), resolving an EID to its current RLOC by querying a mapping system, so a device can move without changing its identifier while remaining reachable.

Lists (; / && / ||)

Operators that chain commands: A ; B runs sequentially regardless of result, A && B runs B only if A succeeds, and A || B runs B only if A fails.

Live response

An interactive incident-response capability in Microsoft Defender for Endpoint that opens a remote shell to a device to fetch files, stop processes, or run scripts on the spot. Live-response permissions can be separated via RBAC, and every action is logged for later audit.

LLDP (Link Layer Discovery Protocol)

A vendor-neutral neighbor-discovery protocol standardized as IEEE 802.1AB. Like CDP, it exchanges neighboring device information at Layer 2, but it also works in mixed-vendor environments beyond Cisco equipment.

LLM-as-a-Judge

Using another FM as an evaluator to auto-score output quality (relevance, factual accuracy, etc.) and fairness at scale and consistently—complemented by human evaluation for critical judgments.

Load average

A system-load metric averaging the number of runnable/running processes; uptime and top show three values (1/5/15 minutes) that you compare against the CPU core count to judge overload.

Load balancer (L4/L7)

A device that distributes load across multiple servers. An L4 load balancer distributes based on IP address and port; an L7 load balancer can interpret application-layer information such as HTTP URL paths and cookies, enabling path-based routing and cookie-based session persistence. Health checks automatically remove failed servers from rotation.

Load balancing (Load Balancer / Application Gateway / Traffic Manager)

Azure services distributing traffic to backends. Azure Load Balancer = L4 (TCP/UDP), regional, fast (internal/public, health probes, backend pools). Application Gateway = L7 (HTTP), regional, URL path-based routing, SSL termination, WAF. Front Door = L7, global (edge delivery, WAF/CDN, reverse proxy). Traffic Manager = DNS-based global routing (real traffic goes straight to the backend). Decide by L4 vs L7 and regional vs global.

Load balancing (load balancer)

A mechanism (or the device/software implementing it) that distributes requests across multiple servers, avoiding concentration on one server and improving availability and scalability. DNS round-robin is one simple way to achieve it.

Load Balancing Algorithms (Round Robin / Least Connections)

Round robin is the simplest load-balancing algorithm, assigning requests to backend servers in sequential, equal turns; it works well when per-request processing load is uniform but can leave load unevenly distributed when processing times vary. Least connections instead routes each new request to the server currently handling the fewest active connections, balancing load more accurately in environments where request processing times differ significantly.

Load-balancing rule

A rule that distributes inbound traffic received on a Load Balancer frontend IP/port across a backend pool, based on health-probe results. The default is 5-tuple hash distribution, with session persistence (source-IP affinity) configurable.

Local network gateway

An Azure object representing the "on-prem side" of an S2S VPN; registers the on-prem public IP and address space (or BGP settings).

Locale (LANG / LC_ALL)

A combination of language, region, and encoding (ja_JP.UTF-8); precedence is LC_ALL (forces all) > LC_* (per category) > LANG (default). When scripts parse command output, pin LANG=C (English, byte order) to remove locale variation. Inspect with locale (-a lists). This is internationalization (i18n) and localization (l10n) configuration.

locate / updatedb

locate searches the index database built by updatedb, so it is fast but blind to files newer than the last index; refresh with updatedb and configure exclusions in /etc/updatedb.conf. When accuracy matters, use find (a live walk).

Locating commands (which/whereis/type)

Three ways to locate a command: which finds the executable on PATH, whereis adds man pages and source, and type also detects aliases and shell builtins (type cd -> shell builtin).

Lock granularity

How coarse or fine the unit of locking is. Row-level locking maximizes concurrency but adds management overhead, while table-level locking is cheaper to manage but reduces concurrency. Intention locks offer a hierarchical middle ground between the two.

Locking and concurrency control

The mechanism that preserves consistency when multiple transactions access the same data concurrently. The LOCK statement acquires an explicit lock; a row lock targets specific rows, while a table lock covers the entire table. PostgreSQL's concurrency control is built around MVCC (multi-version concurrency control), which keeps reads and writes from blocking each other and reduces lock contention.

Log Analytics workspace

A data store that aggregates and retains logs/metrics from various resources. Queried with KQL (Kusto Query Language) for analysis, and underlies Microsoft Sentinel and Azure Monitor alerts. Access control and retention (default 30 days, extendable) are set per workspace.

Log export to BigQuery

Continuously exports audit logs/usage data to BigQuery for SQL-based cross-analysis, long-term retention, and custom reporting.

Log management

The practice of appropriately collecting, storing, monitoring, and analyzing the logs (operation and communication records) produced by systems and network devices. It is used to trace unauthorized access and failures, investigate causes, and preserve evidence (audit trails). Protection against tampering and time synchronization (NTP) across devices are prerequisites for accurate analysis.

Log management and monitoring (audit trail)

The combined practice of collecting and retaining records (logs) of system, application, communication, and error events so they can serve as an audit trail for later investigation and auditing, together with the real-time monitoring needed to detect anomalies as they occur. Logs are often centralized on a separate, write-restricted server to prevent tampering and are retained under a defined retention policy.

Log Replay Service (LRS)

For SQL Managed Instance migrations, continuously restores/applies backups from Blob to enable an online migration with a manual cutover.

Log retention

A per-log-group setting in CloudWatch Logs controlling how long log events are kept before automatic deletion (1 day to 10 years, or never). The default is never-expire, so explicitly setting a retention period is a frequent practical and exam gotcha for cost control.

Log shipping

A simple, mature DR method that periodically copies and restores transaction-log backups to a standby server.

Log-based metrics

Metrics derived from matching log entries; lets you monitor/alert on things like the count of specific errors as a time series.

Logging threshold parameters (log_min_duration_statement/log_autovacuum_min_duration/log_lock_waits/log_checkpoints/log_temp_files)

Monitoring parameters controlling what gets logged. log_min_duration_statement logs slow queries exceeding a threshold duration; log_autovacuum_min_duration logs autovacuum runs that take longer than a threshold; log_lock_waits logs when a lock wait exceeds deadlock_timeout; log_checkpoints logs checkpoint occurrences; log_temp_files logs temp-file usage.

Logic circuit

A digital circuit that performs logic operations on signals represented as binary 0/1 by combining logic gates such as AND, OR, and NOT. Logic circuits are broadly divided into combinational circuits, whose output depends only on the current inputs, and sequential circuits, which contain memory elements such as flip-flops and therefore also depend on past state. They form the basis of a computer's arithmetic and control circuitry.

Logical backup and restore (pg_dump/pg_dumpall/pg_restore)

Tools for SQL-level (logical) backup: pg_dump backs up a single database, while pg_dumpall dumps the whole cluster including roles and tablespaces. pg_restore restores from pg_dump output in custom, directory, or tar format, and its -t option restricts restore to a specific table.

Logical data independence

The property that changes to the conceptual schema (e.g., table structure) do not affect the external schema that applications see. It is a goal of the three-schema architecture, letting tables be added or restructured without rewriting applications.

Logical operations (AND, OR, NOT, XOR)

Operations on the two values true (1) and false (0). AND is true only when both inputs are true; OR is true when at least one input is true; NOT inverts the value; XOR (exclusive OR) is true only when the inputs differ.

Logical replication commands (PUBLICATION/SUBSCRIPTION)

The operational commands for logical replication. On the publisher side, CREATE PUBLICATION defines the set of tables to replicate (via FOR TABLE or FOR ALL TABLES); ALTER PUBLICATION adds or removes tables; DROP PUBLICATION removes the publication. On the subscriber side, CREATE SUBSCRIPTION subscribes to a publication and receives its changes, ALTER SUBSCRIPTION can ENABLE/DISABLE it or REFRESH PUBLICATION (apply changes to the set of replicated tables), and DROP SUBSCRIPTION removes the subscription.

Logical replication conflicts

A state where the subscriber fails to apply a change (e.g., violating a UNIQUE constraint that exists only on the subscriber side). Historically a conflict halted the apply worker and stalled replication until resolved manually. From PostgreSQL 18 onward a conflict-detection framework identifies conflict types such as insert_exists and update_missing, counts them in pg_stat_subscription_stats, and supports automatic resolution options like last_update_wins (detecting *_origin_differs requires track_commit_timestamp=on).

Login control (shadow passwords, /etc/nologin)

Shadow passwords isolate hashes in root-only /etc/shadow. /etc/nologin, when present, refuses non-root logins (an instant maintenance gate whose contents become the message shown).

Login status (who/w/last)

Commands to see who is logged in: who shows current logins, w adds activity and load, and last shows login history from /var/log/wtmp.

Logistic regression

A model that passes a linear combination of features through a sigmoid function to output a probability between 0 and 1, performing binary classification. Despite the name, it's a classifier—and like linear regression, it's interpretable and commonly used as a classification baseline.

logrotate

Automates rotation, compression, and deletion of text logs; the global /etc/logrotate.conf plus per-package /etc/logrotate.d/ define rules like "weekly, keep 4, compress", run periodically.

Long tail

The idea that, when products are ranked by sales, the aggregate revenue from the large number of low-selling items (the tail) can be a significant income source alongside the few best-sellers (the head). This holds especially well for e-commerce sites, which face far lower inventory and shelf-space constraints than physical stores.

Long-term retention (LTR)

Retains weekly/monthly/yearly backups for up to 10 years, meeting compliance requirements.

Longest prefix match

The IP routing principle of preferring, among multiple matching routes, the one with the longest (most specific) prefix. The default route (0.0.0.0/0) is used only as a last resort when no other route matches.

Looker

A business intelligence (BI) tool that visualizes analytics in dashboards to support business use.

Looker Studio

A visualization (BI) tool to easily create and share reports and dashboards.

LookML

A modeling language in Looker to define data metrics and dimensions, keeping measures consistent.

Lookup column

A column referencing a record in another table; creates a one-to-many relationship to link related data (e.g., order→account).

LookUp function (Power Fx)

Returns the first record (or a column value) matching a condition; used to fetch a single record.

Loops and branching

Controlling flow logic with loops (e.g., Apply to each) and branching (condition/switch).

Loose coupling (decoupling)

A design that separates components via queues (SQS), notifications (SNS), or events (EventBridge) instead of direct calls—so failures/load on one side don’t cascade, and parts scale and deploy independently while buffering spikes.

LoRA (low-rank adaptation)

A parameter-efficient fine-tuning technique that trains only a small set of added parameters to adapt a model to a domain—cheaper than full fine-tuning.

Lossless and lossy compression

Lossless compression can fully restore the original data. Lossy compression achieves a higher compression ratio by discarding information that is hard for humans to perceive, but the original data cannot be perfectly restored — image or audio quality degrades slightly.

Low-code

A development approach that builds apps/automation mostly via configuration and drag-and-drop, with little hand-written code (some formulas allowed). Benefits: speed and frontline-led improvement.

Low-code development

A way of developing apps mainly by combining and configuring on-screen components rather than writing much program code. An approach that writes no code at all is called no-code. Its advantage is that even non-professional developers can quickly build business apps.

Low-power design for IoT devices

Design principles for IoT devices that must run long-term on battery or energy harvesting: intermittent operation (sleeping most of the time and waking only when needed), choosing low-power radio protocols (BLE, LPWA, etc.), and aggregating processing at the edge to cut the amount of data transmitted.

LPWA (LoRa / NB-IoT)

A general term for wireless technologies that achieve long-range communication — several to over ten kilometers — at low power. Data rates are low, but a device can run for years on battery alone while covering a wide area, making LPWA suited to IoT use cases such as asset tracking or environmental sensing that collect small amounts of data infrequently over a broad area. LoRa is a proprietary protocol using unlicensed spectrum, while NB-IoT is a standard that runs over the cellular network.

LSA (Link State Advertisement)

The unit of information an OSPF router advertises describing the state of its own links (interface, cost, connected neighbor, etc.). The collection of LSAs gathered from every router forms the link-state database (LSDB), from which each router computes its shortest-path tree via the SPF algorithm. LSA types (Type 1, Type 2, etc.) differ in scope and content.

lspci / lsusb

Commands to inspect attached devices: lspci lists PCI devices (NICs, GPUs), lsusb lists USB devices—used to confirm hardware is physically recognized.

LTV (customer lifetime value)

The total profit a single customer generates for the firm over the entire relationship, from acquisition to churn. Strategists compare it against customer acquisition cost (CAC) to judge whether marketing investment is justified and how much to invest in retaining and deepening relationships with existing customers. Measures that raise retention, purchase frequency, or order value push LTV up and shorten the CAC payback period.

lv* commands (logical volume operations)

LVM commands for logical volumes (LV): lvcreate carves an LV out of a VG, lvextend/lvresize grow it, and lvdisplay/lvs show LV information.

LVM (logical volume management)

An abstraction layer pooling disks (physical volumes, PV) into a volume group (VG) and carving logical volumes (LV) from it; it supports online grow/shrink and point-in-time snapshots.

M&A and alliance (strategic partnership)

M&A (mergers and acquisitions) acquires control of another company and integrates it, gaining businesses or technology quickly. An alliance (strategic partnership) is cooperation without full capital control, or with only minority investment, letting each party stay independent while collaborating in a specific area. Strategists judge which fits the goal better, the speed but high integration cost and risk of M&A or the flexibility but weaker control of an alliance, based on the nature of the resource being sought and how much integration is truly needed.

MAC Address

A MAC address is a 48-bit physical address that uniquely identifies a network interface at the data-link layer, composed of a 24-bit OUI (vendor identifier) and a 24-bit vendor-assigned serial number. Unlike an IP address, it is fixed to the device rather than changing with network topology, and is used to identify frame destinations within a single data-link (L2) segment.

MAC Address Learning

MAC address learning is a function by which an L2 switch dynamically records the mapping between a received frame's source MAC address and the ingress port in its MAC address table (FDB); subsequent frames destined to that MAC address are then forwarded only to the corresponding port. Before learning occurs, or when the destination is unknown, the switch floods the frame to all ports. Entries not referenced within an aging timeout are removed from the table.

MAC address table and MAC address filtering

The MAC address table is the record an L2 switch builds of learned MAC-address-to-port mappings, used to forward frames to the correct port. MAC address filtering restricts which MAC addresses are allowed on a given port, an access-control measure that rejects unregistered devices.

Machine learning (ML)

A technique that learns patterns from data to predict on new data; the foundation of AI.

MACsec (IEEE 802.1AE)

The IEEE 802.1AE standard that encrypts and authenticates frames hop by hop at Layer 2, such as between switches or between a switch and an endpoint. Unlike IPsec, which encrypts end to end or site to site at Layer 3, MACsec protects one adjacent link at a time, guarding against eavesdropping, tampering, and spoofing on that link.

Main memory and cache memory

Main memory is the storage area for programs and data that the CPU reads and writes directly. Cache memory is faster but smaller-capacity memory that bridges the speed gap between the CPU and main memory, speeding up processing.

Maintenance windows

A time window during which planned maintenance (patching, minor version updates) runs on a managed database. Set it to low-impact hours to align planned downtime with availability requirements.

Major incident

An incident with severe business impact and high urgency. It is handled by a dedicated command structure and an expedited procedure with rapid decision-making and communication, separate from the normal flow. Many organizations judge major incidents against predefined criteria and prioritize resources to achieve early recovery.

Major-version tag (@v4)

A tag consumers reference like @v4; providers move the major tag to the latest commit each release so consumers auto-receive fixes.

Make-or-buy analysis

An analysis that compares performing needed work in-house versus procuring it externally, weighing cost, expertise, schedule, and strategic importance. It is performed early in procurement planning and its outcome influences the subsequent choice of contract type.

Malware

A collective term for malicious software created to harm users, including viruses, worms, trojan horses, and ransomware. Infection routes are varied, including email attachments, visiting malicious sites, and USB drives.

Malware analysis (reverse engineering)

The work of uncovering what a malware sample does, what it communicates with, and how far it has spread, by combining dynamic analysis (running the sample in a safe environment and observing its behavior) with static analysis via disassembly/decompilation (reverse engineering) of the code itself. SOC analysts extract IoCs from the results and feed them into detection rules.

Malware removal

The response to a suspected infection: first isolating the device from the network to contain the spread, then running a full antivirus scan and quarantining or deleting any malware found. The scan log confirms what was found and how it was handled, and after removal you verify there is no reinfection. In serious cases a stronger remedy such as reinstalling the OS or restoring from a trusted backup is considered.

man (manual)

Displays a command online manual (man ls); man -k keyword (= apropos) finds related commands by keyword.

MAN and CAN

Among size-based network classifications, a MAN (metropolitan area network) spans a city, while a CAN (campus area network) spans multiple buildings on a university or corporate campus. Both describe an intermediate scale, larger than a LAN but smaller than a WAN.

Man-in-the-middle (MITM) attack

A general term for an attack in which the attacker inserts themselves between two communicating parties, making each believe it is communicating directly with the other, while eavesdropping on or tampering with the traffic. Techniques used to set it up include ARP spoofing, gateway impersonation via a rogue DHCP server, and DNS cache poisoning. Countermeasures include mutual authentication (e.g., verifying digital certificates) and encrypting/integrity-protecting the communication path.

Managed disks

Block storage for VM disks managed by Azure. Types include Ultra, Premium SSD v2, Premium SSD, Standard SSD, and Standard HDD, with snapshots and disk encryption (SSE/ADE).

Managed environment

An enhanced governance mode for environments—sharing limits, usage insights, data policies—applied centrally.

Managed Google Play

Integrates an organization's Google Play store into Intune, allowing approval/distribution of public apps as well as private in-house apps. Used together with Android Enterprise enrollment (fully managed, work profile, etc.), it also centrally manages app auto-updates and app configuration.

Managed identity

An identity letting apps access Azure resources securely without managing secrets; a service principal auto-managed by Azure.

Managed Instance database copy and move

Native operations to copy (replicate) or move (transfer) a database between SQL Managed Instances, used for instance reorganization or environment separation.

Managed instance group (MIG) and instance template

A Compute Engine group that creates identical VMs from an instance template (a VM blueprint), with autoscaling and self-healing.

Managed online endpoint

An endpoint serving real-time low-latency inference where Azure manages infrastructure and autoscale. Kubernetes online uses an existing AKS.

Managed prefix lists

Bundles multiple CIDRs into one named list referenced by security groups and route tables. Changing an entry propagates to all references, simplifying rule maintenance.

Managed Service for Apache Flink

A real-time service that performs in-flight windowed aggregation/transformation on streams, used for low-latency continuous stream analytics.

Managed services (management boundary)

A categorization by how much AWS operates for you. The more fully managed (AWS handles patching/scaling/availability), the lower your operational burden but less control; unmanaged (e.g., EC2) is flexible but self-operated. It frames “where your responsibility ends” in the shared responsibility model.

Managed solution

The read-only (locked) state of a solution distributed to test or production environments. Managed properties control which components can be edited, and the whole solution can be cleanly uninstalled. It cannot be edited directly—changes are made in the unmanaged dev copy and re-exported.

Management group

The top-level container grouping subscriptions; applies policy/access in bulk, inherited downward.

Management plane

The functional plane that carries the traffic an operator uses to manage the device itself — configuration, monitoring, software updates — via things like SSH, HTTPS, SNMP, and NETCONF. It plays a different role from the control plane (which decides forwarding rules) and the data plane (which forwards actual packets); because unauthorized access to the management plane hands over the whole device, restricting access to it is especially critical.

Management reserve

A reserve set aside for unknown risks (unforeseeable in-scope work) that is not part of the cost baseline but is managed as part of the overall project budget. Unlike the contingency reserve, its use requires approval from a higher authority such as the sponsor, and confusing the two leads to an incorrect BAC scope in earned value calculations.

Mandatory Access Control (MAC)

An access-control method in which the system centrally enforces access decisions based on security labels assigned to information and users. Even the owner of the information cannot loosen permissions against policy. It contrasts with discretionary access control (DAC), which leaves decisions to the owner.

Marginal profit and marginal profit ratio

Marginal profit, or contribution margin, is sales minus variable cost (marginal profit = sales minus variable cost), and is the source from which fixed costs are recovered and profit is generated. The marginal profit ratio is marginal profit as a proportion of sales (marginal profit ratio = marginal profit divided by sales), and is used to compute break-even sales = fixed cost divided by marginal profit ratio, equal to fixed cost divided by (1 minus variable cost ratio). Products or businesses with a higher marginal profit ratio see sales increases translate more readily into profit.

Markdown

A lightweight formatting syntax (.md) used widely in Issues, PRs, comments, and READMEs.

Market segmentation

Dividing a market into groups of customers who share similar needs or attributes (age, region, preferences, etc.). In marketing it is the starting point for selecting a group to target and tailoring products and messaging to that segment.

Marketing mix (4P)

A framework for building marketing measures around four perspectives: Product, Price, Place, and Promotion. It organizes marketing from the seller's point of view.

Marketplace apps / third-party app governance

Governs access to Google Workspace Marketplace apps and OAuth-connected third-party apps. Per-app allow/block, API access management (app access control), and trust/restrict settings for unconfigured apps prevent risky integrations.

Matching (reconciliation) method

An audit technique in which the auditor compares two or more records or data sets of different origin (e.g., input slips against processing result lists, or inventory records against physical stock counts) to verify agreement or discrepancy. It objectively verifies the accuracy and completeness of processing, and any discrepancy found becomes the starting point for further investigation.

Materiality

The degree to which a matter could influence the judgments or conclusions reached in an audit. It encompasses not only quantitative magnitude, such as monetary amount, but also qualitative significance, such as operational impact or legal and regulatory implications. The auditor uses materiality judgments to set the scope and depth of procedures, avoiding overinvestment of audit resources in trivial matters.

max_locks_per_transaction

A parameter that determines the server-wide shared lock table capacity. The number of slots is estimated as (max_connections + max_prepared_transactions) x max_locks_per_transaction. In environments with many transactions concurrently accessing large numbers of tables or partitions, too low a value can cause "out of shared memory" errors.

max_parallel_workers

A parameter that sets the cluster-wide cap on worker processes usable for parallel queries. The per-query parallel degree is separately limited by max_parallel_workers_per_gather.

max-parallel

The cap on concurrent matrix jobs; used to manage cost and runner capacity.

Maximum tolerable period of disruption (MTPD/MAO)

The maximum tolerable period of disruption (MTPD, also MAO: maximum acceptable outage) is the longest service interruption the business can tolerate; beyond it the business suffers irrecoverable or severe damage. The recovery objective RTO (recovery time objective) must be set shorter than the MTPD/MAO to leave a margin. The IT service manager estimates the MTPD/MAO from business impact analysis and, treating it as the upper bound, designs the RTO, recovery strategy, and investment accordingly.

MCP (Model Context Protocol)

An open protocol that standardizes how LLM applications connect to tools and data sources. Where each integration once needed bespoke glue code, exposing a capability as an MCP server lets any MCP-aware client (agent) call it in a common format. On AWS, tools implemented in, e.g., Lambda are commonly exposed this way as MCP servers.

MDM (mobile device management) and patch management

MDM (mobile device management) centrally applies security policy — enforced encryption, remote wipe, app restrictions — to the smartphones and tablets an organization issues or authorizes. Patch management is the ongoing operational practice of testing and rolling out OS and software fixes on a planned schedule to shorten the window during which a known vulnerability can be exploited. Both are foundational security management activities alongside hardening and asset management.

Measure

A DAX expression that aggregates; computed at evaluation time (lazy), not stored in the model, and changes with filter context.

Medallion architecture

A design layering data by quality: bronze (raw) → silver (cleanse/join) → gold (aggregate/business-ready), each stored as Delta.

Media access control (CSMA/CD, CSMA/CA)

Media access control on shared media. CSMA/CD (collision detection) is used on half-duplex wired Ethernet to detect collisions and retransmit. CSMA/CA (collision avoidance) is used on wireless LAN, where detecting collisions is hard, waiting/checking before sending to avoid them. A duplex mismatch (one side half-, the other full-duplex) causes frequent late collisions and FCS errors.

Meet meeting policy

Settings that define recording permission and participant controls (external participants, host management) per OU/group.

Meeting customization policies

A Teams Premium policy (Teams admin center: Meetings > Customization policies) controlling the visual branding of meetings. It defines meeting themes—an org logo, brand color, and custom image, up to five per policy—and custom meeting background images (up to 50 per policy) available to participants, applied per tenant or per user. Distinct in purpose from regular meeting policies (which control usable features like recording or chat), as this handles appearance only.

Meeting policies

Control meeting features (recording, transcription, lobby, screen sharing, participant permissions) per user. Distinct from meeting templates (blueprints) and meeting customization policies (appearance).

Meeting templates

A feature that predefines default meeting options (who is a presenter, lobby handling, recording permission, etc.) as a blueprint for specific meeting scenarios (e.g., webinar-like internal events, interviews). Admins can lock settings within a template so organizers cannot override them. Templates are created and assigned per scenario in the Teams admin center.

Memory hierarchy

An arrangement that combines storage devices of differing speed, capacity, and cost in tiers so the whole appears both fast and large. Upper tiers are faster, smaller, and costlier, ordered as registers → cache memory → main memory → secondary storage (SSD, hard disk). Cache memory bridges the CPU–main-memory speed gap, and virtual memory compensates for insufficient main-memory capacity.

Memory parameters (shared_buffers/huge_pages/work_mem/maintenance_work_mem)

The key memory-related performance parameters: shared_buffers sets the size of the shared buffer (data cache); huge_pages controls whether the OS huge-pages feature is used; work_mem sets the working memory available per operation such as a sort or hash join (governing whether an external merge to disk occurs); maintenance_work_mem sets the memory used for maintenance operations like VACUUM and CREATE INDEX.

Memory-mapped I/O

A scheme that maps peripheral device registers into the same address space as memory, so ordinary memory read/write instructions control peripherals. Compared with isolated I/O, which needs dedicated I/O instructions, it simplifies the instruction set and is widely used in embedded processors. Care is needed to mark such regions as non-cacheable so writes are not delayed or dropped by the cache.

Memorystore

A fully managed in-memory cache compatible with Redis/Memcached; caches frequent reads to reduce latency. Not a durable store.

Meraki and network management systems

Meraki (Cisco Meraki) is Cisco's brand of network equipment managed centrally from the cloud, letting an administrator configure and monitor multiple sites from one dashboard. A network management system (NMS) is a general term for software that centrally monitors status, configures, and detects faults for such switches, routers, and access points.

merge

Integrating while preserving both histories with a merge commit; history shows what happened.

Merge and join data

Transforms that combine tables by key into one; join types (inner/left outer) change how matched/unmatched rows are handled.

Merge conflict

A conflict when the same spot is changed differently; resolve manually before completing the merge.

Merge queries (Power Query)

A Power Query operation that joins another table's columns by a shared key column—a column-wise combination equivalent to a SQL JOIN. You choose a join kind (inner, left/right outer, full outer, anti), and the result appears as a nested column you expand to use.

Message ordering

A guarantee that messages are processed in send order. Standard SQS/SNS do not guarantee order (high throughput); FIFO guarantees order per message group. When order matters, address it with group-ID design or a single consumer.

Message queue

A FIFO (first-in, first-out) buffering mechanism for passing data between tasks, or between a task and an interrupt handler. The sender enqueues messages and the receiver can block waiting for one to arrive, coupling tasks more loosely than a direct function call and making it well suited to producer-consumer style processing.

Messages vs events

A message is a command the sender expects to be handled (Service Bus/Queue); an event is a notification of something that happened (Event Grid/Event Hubs)—a key selection axis.

Messaging policies

Allow/disallow chat features per user (edit/delete messages, read receipts, giphy/stickers, priority, translation). Distinct from channel type.

Messaging system

Infrastructure for exchanging messages (events or tasks) between applications; it uses queues to loosely couple sender and receiver, enabling asynchronous data processing.

Messaging/eventing (Service Bus, Event Grid, Event Hubs)

Loose-coupling options. Service Bus = enterprise messaging (queues/topics; ordering/transactions/dedup/dead-letter). Storage Queue = simple, cheap high-volume queue. Event Grid = reactive pub/sub of discrete events (e.g., "blob created"). Event Hubs = high-volume streaming/telemetry ingestion (high throughput, partitions). Message = command; event = notification.

Metadata filtering (RAG)

Attaching attributes (source, date, department, sensitivity, etc.) to chunks and filtering at retrieval to improve relevance and access control—enabling tenant isolation, recency preference, and permission-based visibility together with vector search.

Metaverse

A three-dimensional virtual space built on the internet where users take part as avatars (stand-in characters) to interact with others and carry out activities such as shopping or events. It is realized by applying VR (virtual reality) and AR (augmented reality) technologies.

Metered billing

Products billed by consumption on top of per-seat fees—Actions minutes, storage, Packages, Copilot, GHAS, etc. Use usage reports to find heavy-consuming orgs/repos.

Metric

A metric is the numeric value a routing protocol uses to select the best path, calculated from criteria such as hop count, bandwidth, delay, or cost depending on the protocol. Lower metric values are preferred and installed in the routing table; metrics compare routes within the same protocol, while administrative distance is used to compare routes learned from different protocols.

Metric math

Combines multiple metrics with expressions to derive new time series—e.g., error rate (errors ÷ total), sums, or anomaly-detection bands—for use in alarms and dashboards.

MFA device types

Second factors for MFA: virtual MFA (authenticator TOTP), hardware MFA (physical token), and FIDO security keys (passkeys, strong phishing resistance). Required for root and privileged users; enforce critical actions with the aws:MultiFactorAuthPresent condition.

MFA registration campaign

Nudges users to register stronger authentication methods (e.g., Microsoft Authenticator), migrating gradually from weak methods like SMS. A nudge, not a hard block.

Microcontroller (MCU)

A single-chip embedded processor integrating a CPU core, memory (flash/SRAM), and peripheral I/O (timers, UART, ADC, etc.). Compared with a general-purpose CPU plus external memory, it offers lower cost, lower power, and a smaller footprint, making it the default choice for appliances and IoT devices. Selecting the right MCU for performance, power, pin count, and cost is a starting point of embedded design.

Microservices

An architectural style splitting an application into small, independent services that can each be deployed, scaled, and failed in isolation—at the cost of more inter-service communication and operational complexity. Commonly built on containers or serverless compute plus an API gateway.

Microsoft 365

A SaaS productivity suite delivering email, documents, and meetings in the cloud, used via per-user subscription.

Microsoft 365 admin center

The central admin portal for Microsoft 365. It manages users, licenses, groups, domain names, and org settings, and is the gateway to each workload-specific admin center. Copilot license assignment and usage reports are done here too.

Microsoft 365 Apps deployment

Delivers and updates client Office (Word/Excel) via Click-to-Run. Update channels (Current/Monthly Enterprise/Semi-Annual) control update cadence.

Microsoft 365 Backup

Protection that quickly restores Exchange/SharePoint/OneDrive data from accidental deletion/corruption. Different purpose from Purview retention (compliance preservation).

Microsoft 365 contact

A directory object with no sign-in capability, intended purely as a mail recipient. Used when you want an external contact to appear in the organization's Exchange Online address book or distribution list without granting tenant access—its key distinction from a guest user. Requires no license or Entra ID sign-in.

Microsoft 365 Copilot

An AI assistant embedded in apps like Word, Excel, Outlook, and Teams. It operates only within data the user can already access and creates no new access. Requires a separate license.

Microsoft 365 Groups

A backbone that provides shared membership and resources across multiple services (Teams, SharePoint, Outlook, Planner, etc.), enabling cross-service collaboration from one group.

Microsoft 365 licensing (per-user subscription)

License per user (seat), paid monthly/annually; plans include Business/Enterprise/Frontline; assign in the Microsoft 365 admin center. Differs from AWS/Azure pay-as-you-go.

Microsoft 365 licensing models (E3/E5/Business)

Plans chosen by size and features: Business (Basic/Standard/Premium) for SMBs, Enterprise (E3/E5; E5 adds advanced security/analytics) for large orgs, and the F series for frontline workers.

Microsoft 365 purchasing channels

The classification of routes for procuring Microsoft 365/Azure licenses: an Enterprise Agreement (EA; a multi-year contract for large organizations), a Cloud Solution Provider (CSP; flexible monthly terms and consolidated billing via a partner), and Web Direct (buying directly online from Microsoft). Chosen by organization size and support needs.

Microsoft Agent Framework

An open-source orchestration framework for building complex workflows beyond what a single agent's response can handle, positioned as the successor unifying Semantic Kernel and AutoGen. It supports multi-agent collaboration (role division, handoffs), concurrent sessions across multiple users, and flexible workflow control encompassing both human-in-the-loop (human approval) checkpoints and autonomous execution, all assembled in code. Individual agents are built in the Foundry Agent Service, and this framework composes and runs them together.

Microsoft Authenticator

A smartphone-app method for multifactor and passwordless sign-in. Combining push approval with number matching mitigates accidental approvals and MFA fatigue attacks. Stronger than SMS and a practical method second to passkeys (FIDO2).

Microsoft Azure (with Power Platform)

Microsoft’s cloud platform; Power Platform connects to Azure for advanced development and AI/data (Azure Functions, API Management, Azure OpenAI).

Microsoft Clipchamp

Microsoft 365's video editing/creation app, with templates and screen recording.

Microsoft Cloud Security Benchmark (MCSB)

Microsoft’s set of security best practices that Defender for Cloud assesses by default. It is the basis for Secure Score and maps to industry frameworks.

Microsoft Copilot

A ready-to-use generative AI assistant built into Microsoft 365, Windows, GitHub, and more.

Microsoft Copilot Studio (formerly Power Virtual Agents)

A low-code tool to build chatbots/assistants (assist); conversations use topics (by intent), with generative-AI knowledge and Power Automate integration.

Microsoft Cost Management

Tracks/analyzes actual spend and sets budgets/alerts; distinct from the Pricing Calculator (pre-build estimate).

Microsoft Cybersecurity Reference Architectures (MCRA)

A reference architecture mapping which Microsoft products provide which defensive capabilities across identity/SOC/endpoints/hybrid-multicloud/OT. A "map" used as a design starting point to find capability gaps—distinct from MCSB, which measures conformance.

Microsoft Dataverse

Power Platform’s secure, structured data store (tables) with types, relationships, and fine-grained security—more business-grade than Excel/SharePoint lists; the basis of model-driven apps.

Microsoft Defender for AI services

A cloud workload protection plan in Microsoft Defender for Cloud (officially Microsoft Defender for AI services; formerly Defender for AI workloads). Detects and alerts on runtime threats to AI workloads (prompt-injection attempts, credential misuse, sensitive-data exfiltration, etc.). Posture is visualized in the Data and AI Security dashboard.

Microsoft Defender for Cloud

Scores security posture (Secure Score) and detects misconfigurations/threats to recommend fixes.

Microsoft Defender for Cloud Apps

A CASB (cloud access security broker) that discovers and controls cloud-app usage and shadow IT.

Microsoft Defender for Endpoint

Provides device (endpoint) EDR/protection, rolled out onboarding→endpoint settings→vulnerability management. Distinct from Defender for Office 365 (email protection).

Microsoft Defender for Office 365

Email/collaboration threat protection—threat policies (anti-phishing/spam/malware), Safe Attachments, Safe Links, Threat Explorer, attack simulation. Distinct from device-EDR Defender for Endpoint.

Microsoft Defender portal

A portal unifying Defender XDR signals (email, identity, endpoint, apps) to centrally manage incident investigation/response and Secure Score.

Microsoft Defender Threat Intelligence

Provides external threat info—threat actors, IOCs, threat analytics reports—to match observed indicators against known attacks. Distinct from advanced hunting (your own KQL).

Microsoft Defender XDR

Unifies protection across endpoints/email/identity/SaaS, correlating signals across domains (Endpoint/Office 365/Identity/Cloud Apps).

Microsoft Dynamics 365

A suite of business apps (sales, customer service, finance) built on Dataverse, so it shares data and extensibility directly with Power Platform.

Microsoft Editor

A writing-assistance feature that suggests spelling, grammar, and style improvements across Word and the browser.

Microsoft Entra Agent ID

Gives autonomous AI agents an identity and governs their access with conditional access. Analyze the compromise blast radius in Defender XDR and minimize/revoke access.

Microsoft Entra Application Proxy

Securely publishes on-prem web apps externally without a VPN, fronting them with Entra authentication + pre-authentication. Global Secure Access Private Access is the evolution, supporting non-web protocols too.

Microsoft Entra authentication for Azure SQL

The recommended Azure SQL authentication. Centralized in Entra ID with MFA, Conditional Access, and passwordless connections via managed identity. Enabled by configuring an Entra ID admin.

Microsoft Entra Cloud Sync

A lightweight method to sync on-prem AD to Entra. Lightweight provisioning agents can be deployed in multiples for high availability, suited to multiple forests or fragmented AD. Contrast with the single feature-rich Connect Sync.

Microsoft Entra Connect Health

Monitors the health, errors, and performance of sync/authentication agents (Connect Sync, PTA, AD FS, etc.), giving visibility into the hybrid identity foundation.

Microsoft Entra Domain Services

A managed domain service that provides domain join, Group Policy, and legacy authentication without managing your own domain controllers. In Azure Virtual Desktop it is one session-host identity scenario, sitting between self-managed AD DS and cloud-native Entra ID join.

Microsoft Entra hybrid join

A method that joins a device already joined to on-premises Active Directory to Entra ID as well, via Entra Connect synchronization, giving it both authorities. Used by organizations in a migration period wanting to run on-prem Group Policy (GPO) alongside Intune/Conditional Access, or in environments with legacy apps still dependent on on-prem AD.

Microsoft Entra ID

Cloud identity/access management (formerly Azure AD) providing MFA/SSO/Conditional Access; distinct from on-prem AD DS.

Microsoft Entra ID Protection

Computes user/sign-in risk from leaked credentials, impossible travel, etc., integrating with Conditional Access.

Microsoft Entra Internet Access

Part of Global Secure Access (SSE). Inspects/controls users’ internet/SaaS-bound traffic as a secure web gateway with cross-tenant protection. Distinguished by destination from Entra Private Access (ZTNA to internal apps).

Microsoft Entra join

A method that fully, cloud-natively joins an organization-owned device to Microsoft Entra ID. The device authenticates solely against Entra ID and can be brought under full management via Intune auto-enrollment (automatic MDM enrollment). It does not join on-prem AD, making it the default choice for cloud-only organizations or new devices.

Microsoft Entra Kerberos

Enables SSO from Entra-joined devices to Kerberos-dependent on-prem resources (e.g., file shares) for hybrid identities.

Microsoft Entra password protection

Rejects weak/guessable passwords via global/custom banned-password lists; extensible to on-prem AD for a consistent password policy across cloud and on-prem.

Microsoft Entra Permissions Management

Microsoft's CIEM product. Analyzes permissions across identities and resources spanning multi-cloud (Azure/AWS/GCP), surfaces a Permission Creep Index score, and proposes remediation for unused entitlements. Distinctive for giving one dashboard view of effective permissions across multiple clouds.

Microsoft Entra Private Access

Replaces VPN by granting identity-based, per-app (Zero Trust) access to internal apps, reaching only the needed apps rather than the whole network.

Microsoft Fabric (capacity, workspace, experiences)

A SaaS analytics platform unifying data integration, analytics, and BI. Hierarchy: capacity → workspace → items. Capacity is the compute+billing unit (F SKUs, Power BI Premium P SKUs; consumes capacity units (CU); smoothing/bursting level usage; can pause/resume). A workspace is the collaboration/access unit. Experiences are role-specific (Data Engineering/Data Factory/Data Warehouse/Real-Time Intelligence/Power BI). Defining trait: all experiences share OneLake. It is a unified SaaS, not a bundle of PaaS.

Microsoft Fabric mirroring (Cosmos DB)

A feature that mirrors Cosmos DB data into Microsoft Fabric OneLake near-real-time for analysis in Fabric—used vs the batch-oriented Cosmos DB Spark connector.

Microsoft Forms

A tool to create surveys/quizzes and collect responses; a response can trigger Power Automate to store in Dataverse or notify.

Microsoft Foundry hub and project

The foundation for generative-AI development. In the hub-based setup, a hub bundles shared resources, connections, security, and cost management, and projects beneath it manage individual workspaces, models, and flows. Since 2025 a hub-less Foundry project (lightweight, standalone) setup is also available.

Microsoft Graph activity logs

Logs recording Graph API calls against the tenant (which app/user accessed which resource via API), used to investigate OAuth-app abuse or suspicious API access. Distinct from sign-in logs (authentication events).

Microsoft Graph and grounding

Copilot accesses organizational context—email, files, chats, calendar—via Microsoft Graph and, respecting the user’s permissions, grounds responses in relevant information. Access scope determines response scope.

Microsoft Graph PowerShell

A PowerShell module to automate Entra/Microsoft 365. The successor to the older AzureAD/MSOnline modules, used to programmatically run repetitive tasks like attribute updates and license assignment.

Microsoft identity platform

The auth platform for app sign-in and token acquisition; register the app and use MSAL to obtain OAuth2/OIDC tokens to access resources.

Microsoft Intune

A cloud service to manage/secure devices and apps; MDM manages the device itself, MAM manages in-app data; integrates with Conditional Access.

Microsoft Lists

An app to track and manage information or tasks as lists, with templates, views, and rules to organize work data.

Microsoft Power BI

A BI tool to visualize/share data as reports (multi-page interactive analysis) and dashboards (single-screen summary).

Microsoft Power Pages (formerly Power Apps portals)

A Power Platform product to build low-code external-facing websites/portals; data is stored in Dataverse, and external users are controlled by anonymous/sign-in plus permissions. It is the external-facing counterpart to Power Apps (internal apps).

Microsoft Power Platform

Microsoft’s low-code/no-code platform for analytics, apps, automation, and conversation; even citizen developers can improve work. Integrates with M365/Dynamics 365/Azure.

Microsoft Priva

A solution to manage personal-data privacy risks and handle data subject requests (DSRs), detecting and remediating over-retention or oversharing of personal data.

Microsoft Project

A full-featured project-management tool for scheduling, dependencies, and resource management on large projects.

Microsoft Purview

Microsoft's unified governance and compliance solutions: information protection, data lifecycle, risk management, eDiscovery, and auditing, plus cross-estate data governance via the data map/catalog (integrating the former Azure Purview).

Microsoft Purview Data Loss Prevention (DLP)

Prevents sensitive information from leaking outside the org by applying DLP policies to Exchange Online/SharePoint Online/OneDrive/Teams to block sharing/sending and warn via policy tips. Distinct from labels (classify) and retention (preserve).

Microsoft Search

A unified search that spans people, files, sites, and mail, accessed from the search box in each app.

Microsoft Secure Score

A measure that quantifies an organization’s security posture with recommended improvement actions and progress, viewed in the Microsoft Defender portal.

Microsoft Security Copilot

Applies generative AI to security operations (SecOps). Configure a workspace (capacity = SCUs) and permissions/roles, connect data sources/products via plugins, and run SecOps tasks semi-autonomously with Microsoft/Security Store agents—governed with least privilege within the user’s existing permissions.

Microsoft Security Exposure Management

Unifies identity/endpoint/cloud/data to visualize attack paths from external entry to critical assets, supporting a posture process that prioritizes choke points on lethal paths.

Microsoft Sentinel

A cloud-native SIEM + SOAR that collects logs and detects, investigates, and auto-responds to threats.

Microsoft Sway

An app to quickly create and share polished newsletters and presentations.

Microsoft Teams

A collaboration hub for chat, meetings, calls, and teamwork; files are stored behind the scenes in SharePoint/OneDrive.

Microsoft Teams Network Assessment Tool

Sends real media traffic to measure packet loss/latency/jitter, evaluating whether the network suits Teams. Distinct from Network planner (advance planning).

Microsoft Teams Rooms

Dedicated Teams devices for meeting rooms; configure a resource mailbox account and the system, and manage firmware.

Microsoft To Do

A personal task (to-do) management app that syncs with Planner and Outlook tasks.

Microsoft Tunnel

A standard, no-extra-cost Intune feature—a Linux-based gateway VPN providing secure access to MDM-enrolled devices. Providing per-app access to unenrolled BYOD devices managed only via MAM requires a separate product, Microsoft Tunnel for Mobile Application Management (Tunnel for MAM), part of the Intune Suite/MAM add-on; it is this MAM version that integrates with app protection policy to restrict access to internal resources to work apps only.

Microsoft Visio

A diagramming app for flowcharts, org charts, network diagrams, and more.

Microsoft Viva

An employee experience platform (learning, insights, engage)—a different category from Teams’ real-time conversation.

Migration Evaluator

A free assessment service that builds a data-driven cost estimate (business case) for migrating on-premises environments to AWS (formerly TSO Logic). It collects current server utilization and projects AWS costs and savings to support migration decisions.

Migration methods (big bang, phased, parallel)

Approaches to switching from an old system to a new one. Big-bang (all-at-once) migration cuts over all functions and sites at once; it is short and low-cost but high-risk because a failure affects the whole system. Phased migration switches functions or sites piece by piece, spreading risk but lengthening the migration and requiring management of coexisting old and new systems. Parallel operation runs old and new systems concurrently for a period and reconciles results to verify them, giving high assurance but incurring double running cost. The architect selects a method from the tolerances for business interruption and risk.

Migration strategies (the 7 Rs)

A taxonomy of migration approaches chosen per workload: rehost (no change), replatform (minor optimization), refactor (rebuild), repurchase (go SaaS), retire (decommission), retain (keep), relocate (move as-is). Choose by the effort-vs-value trade-off.

Migration strategy (lift-and-shift / lift-shift-migrate)

Lift-and-shift rehosts to Azure VMs with OS/DB unchanged (minimal change). Lift-shift-migrate to HANA converts/optimizes the DB to SAP HANA during migration. Choose by requirements and downtime tolerance.

Migration strategy (lift-and-shift/improve-and-move/refactor)

Lift-and-shift = move as-is (fastest, least change); improve-and-move = slight optimization; refactor = rebuild cloud-native (most effort, biggest payoff). Choose by requirements.

Milestone

Groups issues/PRs by release/deadline and shows completion and due dates.

Mirroring

Replicates changes from external databases (Azure SQL, Snowflake, Cosmos DB) to OneLake in near real time using CDC, enabling analytics without building ETL.

MITRE ATT&CK framework

A publicly maintained knowledge base (matrix) from MITRE that systematically catalogs the tactics, techniques, and procedures (collectively TTPs) observed in real-world attacks. Defenders use it to visualize which techniques their own detection and response coverage actually addresses.

MITRE CAPEC

A knowledge base published by MITRE that systematically classifies and enumerates attack patterns (Common Attack Pattern Enumeration and Classification). It provides a common taxonomy of adversary techniques used as a reference for threat analysis and security design.

Mixed instances policy

Combines multiple instance types and an On-Demand/Spot ratio within one Auto Scaling group—resilient to Spot interruptions while balancing capacity assurance and cost savings.

ML data preparation (encoding/scaling/imbalance)

Shaping raw data for learning. Encoding turns categories numeric (one-hot/ordinal/target); scaling = standardize (z-score)/normalize (Min-Max); imbalance = SMOTE oversampling/class weights (evaluate with F1/PR-AUC). Fit transforms only on post-split training data (prevent leakage).

MLflow tracking

Experiment tracking natively integrated in Azure ML. Logs training via log_metric/log_param/log_artifact and autolog to compare runs.

MLmodel file and signature

The metadata file of an MLflow model. It describes the input/output schema (signature) and flavors, and can package a feature-retrieval spec with the model artifact.

MLOps (SageMaker Pipelines / Model Registry)

Run the ML lifecycle reproducibly, automatically, and under governance. Pipelines automate process→train→evaluate→register/deploy as a DAG, with an evaluation step + condition as a quality gate. The Model Registry versions models and governs production deployment via approval status. Automate retraining with CI/CD (CodePipeline) or EventBridge.

MMU/MPU (memory protection)

An MMU (memory management unit) translates virtual addresses to physical addresses and isolates each process into its own memory space. An MPU (memory protection unit) does not virtualize addresses; instead it defines a small number of configurable protected regions (with size and alignment constraints) over physical addresses and restricts access permissions (read/write/execute) — a lighter-weight mechanism that needs no page table. Embedded MCUs that prioritize real-time behavior often use an MPU to prevent memory corruption from runaway code while avoiding MMU overhead.

Modality mapping (preprocessing routing)

Routing preprocessing to the right AWS service by input type: documents/images → Textract, audio → Transcribe, general image understanding → Rekognition/multimodal FM, text normalization → Comprehend—extracting and normalizing before passing to generative AI.

Model and flow evaluation

Measures generative-AI output quality via metrics like groundedness, relevance, fluency, and similarity, plus manual evaluation, to improve flows and model choice.

Model benchmarks comparison

Evaluation that compares language models on metrics like accuracy, coherence, cost, and throughput to select candidates fit for the use case.

Model catalog

A catalog in Azure AI Foundry / Azure ML to discover, compare, and deploy many foundation models (OpenAI, Hugging Face, Meta, etc.).

Model customization (fine-tuning / continued pre-training / distillation)

Ways to adapt an FM. Fine-tuning adjusts behavior with labeled examples (small data, task-specific); continued pre-training injects knowledge from large unlabeled domain data; distillation trains a small model on a large model’s outputs to cut cost. Often first check whether RAG/prompting suffices before customizing.

Model deployment options (Foundry)

Ways to consume Foundry models: serverless API (pay-as-you-go, ready to use) vs managed compute (deploy to a dedicated endpoint), chosen by requirements from the model catalog.

Model evaluation metrics (precision/recall/F1/AUC/RMSE)

Classification rests on the confusion matrix (TP/FP/TN/FN): precision/recall/F1/AUC, PR-AUC. For imbalance, accuracy misleads—use F1/PR-AUC. Reduce misses = recall; reduce false alarms = precision. Regression uses RMSE (penalizes large errors)/MAE (robust)/R-squared. Tune precision/recall via the threshold.

Model Garden

A Vertex AI catalog to browse and choose among diverse foundation models (Google, open, third-party).

Model monitoring & drift detection

Continuously comparing a production model against its training-time baseline to detect data drift (input distribution shift) or model drift (prediction-quality decay). Input/output data is typically captured and stored, and detected drift triggers a retraining pipeline.

Model registry

A place to version, register, and reference trained models with stages and lineage, used to select what to deploy.

Model registry (generative-AI versioning)

A registry that versions models, prompt configurations, and customized FMs—enabling approval, staging, and rollback. It links the provenance and evaluation results of production models so you can instantly revert to a prior version on issues.

Model relationships

Links between tables; fact↔dimension is typically one-to-many, single-direction. Use bidirectional cross-filter only when needed (watch ambiguity/performance).

Model row-level security (roles)

Defines roles in a semantic model and restricts visible rows via DAX predicates; dynamic RLS uses USERPRINCIPALNAME to scope to the user’s rows.

Model simplification (quantization/distillation/pruning)

Techniques to cut production inference latency, model size, and cost: quantization (lower-bit), distillation (transfer knowledge to a smaller model), pruning (remove unneeded weights); trade off against accuracy.

Model tiering / cascading

Routing by query difficulty—small/cheap models for easy queries and large models only for hard ones—to optimize cost while preserving quality.

Model transparency (AI Service/Model Cards)

AWS AI Service Cards / SageMaker Model Cards document a model’s intended use, performance, limitations, and training-data considerations, supporting accountability and governance.

Model-driven app

A Power Apps app type built on the Dataverse data model (tables), where layout (forms/views) is auto-generated; suited to data-centric, complex processes (CRM-like).

Model-driven programmability

The idea of operating a device's configuration and state through a common data model, such as YANG, rather than issuing device-specific CLI commands one by one. As long as the model is the same, the same code and process can drive devices from different models and even different vendors, which is what lets automation scale.

Modern data warehouse architecture

The analytics flow: ingest → store (data lake) → prepare/transform → model/serve (DWH) → visualize. It combines batch and stream, with Synapse/Fabric covering each stage.

Modernizing legacy code

Assistance to rewrite old syntax/deprecated APIs/verbose code toward modern style; adopt after verifying semantic equivalence via tests.

Module coupling and cohesion

Two measures of how well a system is divided into modules. Coupling expresses the strength of dependency between modules; lower coupling is better for independence (data coupling is best, content coupling worst). Cohesion (strength) expresses how strongly the functions inside a single module belong together; higher is better (functional cohesion is best, coincidental cohesion worst). The design guideline is 'low coupling, high cohesion.'

Module decomposition techniques and information hiding

Design techniques for decomposing a program into independent modules (e.g., STS decomposition, common-function decomposition) combined with information hiding—concealing a module internal implementation and exposing only its public interface. Together they localize the impact of change and improve maintainability.

Module partitioning techniques (STS/TR/common-function)

A family of techniques for splitting a program into maintainable units. STS partitioning divides a data flow diagram at its maximum-abstraction input and output points into Source, Transform, and Sink; TR (transaction) partitioning routes processing by the type of input transaction; common-function partitioning extracts functions shared by several places into independent modules. A system architect chooses among them by the nature of the processing to obtain a high-cohesion, low-coupling structure.

Monitoring and optimization (Query Store, DMVs, automatic tuning)

Measure first to find bottlenecks. Query Store keeps query history, plans, and wait stats for regression detection and plan forcing. DMVs expose live internal state (wait stats, blocking) via SQL. In the execution plan, watch scan vs seek, key lookups, and non-SARGable predicates; improve with indexes (create missing, drop unused, rebuild fragmented) and updated statistics. Azure SQL automatic tuning (auto-apply recommended indexes, FORCE LAST GOOD PLAN) and intelligent query processing help.

Monitoring hub

A Fabric monitoring view listing run history, status, and duration for pipelines/notebooks/Spark.

Monolith

An architectural style that bundles all of an application's functionality into one large codebase and deployment unit. Simple early on, but as it grows the deployment unit becomes coarse, often forcing a full redeploy for even a small change.

Morphological analysis

In natural language processing, the process of splitting a sentence into the smallest meaningful units (morphemes) and tagging each with information such as part of speech. Unlike English, Japanese has no spaces between words, so morphological analysis — determining word boundaries using a dictionary and grammar rules — is a prerequisite for downstream processing such as syntactic parsing.

MOT (Management of Technology)

A management approach used by technology-based businesses to continuously translate the outcomes of technological development into business results and increased corporate value.

MPLS

A label-switching technique that attaches labels to packets so routers in the network forward them by label without re-parsing the IP header each time. As the basis of IP-VPN services, it isolates per-customer routing over a shared network and efficiently provides any-to-any site connectivity.

MRP (material requirements planning)

A production-control technique that works backward from a product's production plan and bill of materials (BOM) to determine what to procure or manufacture, when, and in what quantity. Based on demand forecasts, it produces to a plan that helps avoid excess or shortage of inventory and optimizes the timing of parts and material orders. IT strategists judge when MRP is the better fit versus JIT/kanban approaches that are closer to make-to-order, based on the industry and production style involved.

MSDP (Multicast Source Discovery Protocol)

A protocol that shares multicast source information across multiple PIM-SM domains, each with its own RP. Because an RP only knows about sources within its own domain, MSDP peers notify each other's RPs about sources that exist elsewhere, letting a receiver in one domain receive multicast traffic that originates from a source in a different domain.

MST (Multiple Spanning Tree)

The IEEE 802.1s standard that groups multiple VLANs into a small number of spanning-tree instances, rather than running one PVST+ instance per VLAN, reducing CPU load. For switches to belong to the same MST region, their region name, revision number, and VLAN-to-instance mapping table must all match exactly.

MTA and mail forwarding (aliases / .forward)

An MTA (postfix, exim; SMTP port 25) receives and delivers mail. System-wide forwarding goes in /etc/aliases and must be applied with newaliases after editing; per-user forwarding uses ~/.forward. Send with mail; check the pending queue with mailq.

MTBF (mean time between failures)

For a repairable system, the average operating time from one failure to the next. A larger value means fewer failures and higher reliability. Computed as total operating time ÷ number of failures.

MTTR (mean time to repair)

The average time from a failure until recovery. A smaller value means faster recovery and better maintainability. Computed as total repair time ÷ number of failures; it is part of the denominator in availability = MTBF ÷ (MTBF + MTTR), assessed together with MTBF (mean time between failures) for reliability and maintainability.

MTU and jumbo frames

The maximum packet size on a path: up to 9001 within a VPC (jumbo frames), 1500 over an IGW/VPC peering, 8500 over Transit Gateway, and up to 1500 over Site-to-Site VPN (less in practice with IPsec). Exceeding a smaller MTU with the DF bit set requires path MTU discovery’s ICMP (Fragmentation Needed); blocking it in an SG/NACL causes the classic failure where connections establish but large transfers hang.

MTU and MSS

MTU (Maximum Transmission Unit) is the largest upper-layer packet (such as an IP packet) that a data-link frame can carry (for example, 1500 bytes on Ethernet). When encapsulation (e.g., VPN) adds headers, the effective MTU shrinks, increasing fragmentation/retransmission for large packets so that only certain apps slow down. MSS (Maximum Segment Size) is the max data TCP sends per segment; adjusting it for the tunnel overhead avoids fragmentation.

Multi-account network design

Aggregates many accounts/VPCs via a Transit Gateway or Cloud WAN hub, optimizing security and cost with a shared-services VPC, centralized egress, and centralized inspection (inspection VPC).

Multi-account strategy

Separating workloads, environments, and teams by account to delimit billing, security, and blast radius. Governed with Organizations + OUs + SCPs, and Control Tower vends standardized accounts (account vending). A landing zone is the foundation.

Multi-admin approval (Intune)

A mechanism that holds high-impact configuration changes (e.g., running a script) pending approval from an admin other than the requester before applying them. Implements a four-eyes principle preventing a single admin's mistake or insider misuse from immediately hitting production.

Multi-cloud

Using two or more public cloud providers together; to avoid lock-in or pick best-of-breed.

Multi-factor authentication (knowledge, possession, inherence)

An authentication method that combines two or more different types of factors — knowledge (e.g., a password), possession (e.g., a smartphone or IC card), and inherence (e.g., a fingerprint or face) — to verify identity, making unauthorized login harder even if one factor is compromised.

Multi-factor authentication (MFA)

Strengthens identity proof with a second factor beyond a password.

Multi-Region (active-active / active-standby)

Deploying across Regions for regional-failure resilience and low latency. Active-active = both Regions serve traffic (highly available, costlier, data-consistency challenges); active-standby = one stands by (promoted on failover). Built with Route 53, Global Accelerator, and global tables.

Multi-Region Access Point

A feature providing one global endpoint to access S3 buckets distributed across multiple Regions. Built on AWS Global Accelerator, it automatically routes requests to the Region closest to the requester, used for failover and latency improvement.

Multi-region writes and conflict resolution

A configuration enabling writes in all regions for low latency and high availability. Concurrent updates of the same item across regions cause conflicts, resolved by Last Write Wins (LWW, default) or a custom conflict-resolution stored procedure. Not usable with strong consistency.

Multicast

A communication mode that delivers data only to hosts that joined a specific group. Like broadcast, it's often not natively supported by cloud virtual networks; where it's required, teams use a dedicated feature such as a transit-gateway's multicast capability, or redesign around unicast instead.

Multimedia

Handling multiple kinds of information (media) — text, still images, video, audio, and so on — in an integrated way, and the technology or content that does so. Combining several media, as in web pages or e-learning materials, can increase expressiveness and clarity.

Multiplexing

Multiplexing is a technique for sending multiple signals or data streams simultaneously over a single transmission medium, with schemes including FDM (frequency division), TDM (time division), WDM (wavelength division, used in optical fiber), and CDMA (code division). It allows efficient sharing of a single physical link, but requires the receiver to correctly demultiplex the combined signal back into its original streams.

Multitenant organization (MTO)

A configuration to operate multiple tenants as one integrated organization. Different in purpose from shared channels (per-channel collaboration).

Multivalued dependency

A relationship where fixing the value of one attribute (or attribute set) determines a set of values for another attribute, independent of yet other attributes. When multiple independent multivalued dependencies coexist in one table, redundant combinations result, which decomposition to 4NF resolves.

Multiversion concurrency control (MVCC)

A concurrency-control scheme that keeps multiple versions of a row across updates, letting each transaction read a snapshot from its start time so reads never block writes (and vice versa). It achieves higher concurrency than pure locking and underlies the default isolation implementation in many modern DBMSs.

Mutex

A synchronization primitive that lets multiple tasks access a shared resource exclusively. It resembles a binary semaphore (count of 0/1) but differs in having the concept of ownership — only the task that locked it may unlock it — which is what makes priority inheritance protocols applicable. Embedded RTOSes use mutexes to serialize access to shared variables or hardware resources.

MVC and the Observer pattern

MVC (model-view-controller) separates data (model), display (view), and the glue that connects them (controller) to keep code understandable and maintainable. The Observer pattern automatically notifies a set of registered observers whenever a subject's state changes, and underlies event-driven mechanisms generally.

MX record

A DNS record that specifies which mail server should receive mail for a domain. Multiple records can carry a priority (preference value), with lower numbers preferred. In Google Workspace, pointing MX to Google's mail servers after domain verification is what enables mail delivery.

NAC (Network Access Control)

Network Access Control: a mechanism that checks a device's security posture (patch level, whether antivirus is present, and so on) before it connects to the network, quarantining or restricting devices that do not meet the required standard.

Named values (APIM)

Centralizes constants/secrets used in policies; secrets are referenced securely via Key Vault integration.

Namespaces

A Linux kernel feature that isolates resources such as process IDs, network stacks, and mount points so a process sees its own independent view of the system. Along with cgroups, it is the foundational technology behind containers.

Naming policy

Enforces prefixes/suffixes and blocked words in team/group names. Distinct from an expiration policy (which expires unused groups).

NAPT (IP masquerade)

A technique letting multiple private-IP hosts share one global IP address for Internet access by also translating port numbers, managing flows via an IP-and-port mapping table. ESP (protocol number 50, having no port number) cannot be translated as-is, so IPsec VPN needs NAT-T to cope.

Narrative visual (Copilot)

A visual that auto-explains key points in natural-language text, generatable via Copilot; always verify the output.

NAT (Network Address Translation)

A mechanism that translates private IP addresses to public IP addresses and back, running on a router or gateway so many internal hosts can share a small number (or just one) of public IPs to reach the internet (NAPT / IP masquerading). On Linux this is implemented via the iptables MASQUERADE target, among others.

NAT instance vs. NAT gateway

Two ways to provide egress for private subnets. A NAT gateway is managed, highly available (redundant in an AZ), and auto-scaling (recommended). A NAT instance is a self-run EC2 (requires disabling source/destination check, is a single point of failure, cheap/special-purpose).

NAT-T (NAT traversal)

A mechanism to establish IPsec VPN from behind NAPT. Since ESP packets lack a port number and cannot be translated by NAPT, NAT-T detects NAPT during IKE negotiation and encapsulates ESP in UDP (commonly port 4500) so NAPT devices can translate and forward it like ordinary UDP traffic.

Native VLAN

The default VLAN that a trunk port forwards untagged under IEEE 802.1Q. If the native VLAN configured on each end of a trunk does not match, frames can land in the wrong VLAN or enable a VLAN hopping attack.

Natural join

A join operation that automatically joins tables on columns with matching names using equality, merging the duplicate columns into one. It avoids having to spell out the join condition, but care is needed since an unintended matching column name can produce an incorrect join.

Natural Language API

A pretrained API that analyzes sentiment and entities in text, used for tasks like review sentiment analysis.

Natural language processing (NLP)

The field analyzing language (text/speech) to understand meaning, sentiment, and intent; translation/summarization.

Navigate / Back functions

Navigate moves to a specified screen; Back returns to the previous one—used for canvas-app screen transitions.

Need-to-know principle

While the principle of least privilege limits users to the minimum access rights needed for their duties, need-to-know goes further by restricting access to only the specific information that is actually required for the task at hand—regardless of whether a broader permission exists. It is used for finer-grained information access control, such as preventing a user from viewing case details outside their own assignment even if their role would technically permit it.

needs (job dependency)

A key controlling job order; needs: [A, B] declares "run after A and B complete." It is also the path to read prior jobs’ outputs.

Nested interrupt

A mechanism that accepts a higher-priority interrupt while a lower-priority interrupt handler is still running, suspending the current handler to service the more urgent one first. It preserves responsiveness to urgent events, but it increases stack consumption and can cause inconsistencies if critical sections within handlers are not designed carefully.

Nested loop join

A join algorithm that, for each row of the outer table, scans the inner table to find matching rows. It works well when one side is small or the inner join column is indexed, but comparison count grows multiplicatively when both tables are large.

NETCONF, RESTCONF, and YANG

YANG is a data-modeling language that defines a device's configuration and state as a hierarchy of leaves, lists, and containers. NETCONF is a protocol that runs over SSH using XML messages to push YANG-modeled configuration transactionally into datastores such as candidate and running. RESTCONF is a more approachable protocol that accesses the same YANG models over HTTP with JSON/XML, mapping GET/POST/PUT/PATCH/DELETE onto CRUD operations.

NetFlow

A technology by which routers and switches export the traffic they see as flow-level statistics keyed by the 5-tuple — byte and packet counts, start and end times, and so on. Because it does not store full packets, it is lightweight and well suited to understanding large-scale traffic patterns and detecting anomalies (a leading example of transaction data).

Network Access Analyzer

Statically analyzes configuration (without sending packets) to surface paths that can reach resources that should not be reachable, defined via a scope. Used to detect unintended network exposure (overly open paths). Reachability Analyzer determines reachability and the blocking point, while CloudWatch handles trend monitoring—distinct roles.

Network ACL (NACL)

Traffic control at the subnet level; stateless (return traffic must be explicitly allowed), supports both allow and deny rules, and is the place to block a specific IP.

Network Address and Broadcast Address

Within an IPv4 subnet, the network address (host bits all zero) identifies the subnet itself, while the broadcast address (host bits all one) targets all hosts on that subnet simultaneously. Neither is assignable to a host, so usable host count equals the subnet's total addresses minus two.

Network configuration (ip / ifconfig / nmcli)

Viewing/changing host networking: the current standard is the ip command (ip addr for addresses, ip route for routes), legacy is ifconfig/route. ip/ifconfig changes are temporary and vanish on reboot; persist via NetworkManager nmcli or config files. ifup/ifdown bring interfaces up/down from config. The hostname is in /etc/hostname.

Network Connectivity Center (NCC)

A service that connects spokes (VPC/hybrid/producer) to a hub to centrally manage reachability across many networks; unlike non-transitive VPC peering, NCC achieves transitive reachability via hub-and-spoke.

Network connectivity insights

Evaluates and improves each location’s connection path to Microsoft 365 (optimal egress, latency). Distinct from Service Health (Microsoft-side outages).

Network endpoint group (NEG)

A load balancer backend unit that groups container-native (GKE), serverless (e.g., Cloud Run), or internet endpoints; chosen vs managed instance groups (MIGs) by need.

Network Firewall stateful rules

Inspects traffic at VPC subnet boundaries with stateless rules (fast allow/deny) and stateful rules (connection tracking, Suricata-compatible signatures for domain/protocol inspection)—used for egress domain filtering and IPS.

Network Intelligence Center

A suite for network visualization, diagnosis, and optimization: Network Topology (visualize), Connectivity Tests (static route/firewall diagnosis), Performance Dashboard (packet loss/latency), Firewall Insights, Network Analyzer (automatic config diagnosis), and Flow Analyzer.

Network Load Balancer (NLB)

An ultra-high-performance L4 load balancer. It has static IPs (per AZ), can preserve client IP, and is used for cross-zone load balancing and exposing services via PrivateLink.

Network planner

A planning tool that models required bandwidth and impact in advance from sites/personas/network sites before a Teams rollout. Distinct from the Network Assessment Tool (which measures quality with real media).

Network profiling and server profiling

Both build a baseline of normal state so deviation from it can be flagged as anomalous. Network profiling baselines throughput, session duration, ports in use, and critical asset space. Server profiling baselines listening ports, logged-in users, running processes, scheduled tasks, and installed applications.

Network security group (NSG)

Applies allow/deny rules by source/destination/port at the subnet or NIC level.

Network segmentation

A design that divides a network into multiple smaller zones and controls traffic between them with firewalls or VLANs. If one zone is compromised, the design limits how far the damage can spread into other zones.

Network Service Tiers

Network performance/cost choice: Premium (Google backbone, global, high performance) and Standard (cost-focused, regional).

Network tiers

Tiers selecting egress path quality: Premium (Google backbone, high quality) vs Standard (cost-first), trading performance against cost.

Network topology

The arrangement of network devices and cabling. Physical topology describes how cabling is actually laid out (star, bus, ring, mesh, and so on), while logical topology describes the path data actually follows. Most enterprise LANs today use a switch-centered physical star topology.

Network Watcher tools (IP flow verify, Connection Monitor, next hop)

Network Watcher diagnostic tools for visibility and isolation. IP flow verify instantly decides whether a specific source/destination/port is allowed/denied by NSGs (with the matched rule name). Connection Monitor continuously monitors reachability, latency, and packet loss between endpoints. Next hop shows a packet’s actual next hop to isolate UDR mistakes. NSG/VNet flow logs record allowed/denied traffic to Storage, visualized via Traffic Analytics. Also packet capture, connection troubleshoot, and topology. Pick the tool for “is the NSG blocking, or a routing issue?”

Neural network

A computational model inspired by biological neurons, built by connecting multiple layers of units that take a weighted sum of inputs and pass it through an activation function to produce an output. During training, the output error is propagated backward (backpropagation) to update the weights of each layer so the network approximates the relationship between inputs and outputs.

NFV (Network Functions Virtualization)

A technology that implements functions formerly provided by dedicated hardware appliances (firewall, load balancer, router, etc.) as virtualized software (VNFs) on commodity servers, eliminating per-function hardware procurement and letting functions scale up/down in software. Its focus differs from SDN, which addresses control/data-plane separation.

NGFW, stateful firewall, and web content filtering

A stateful firewall tracks the state of a connection (session) and permits or denies based on it. A next-generation firewall (NGFW) adds capabilities such as application awareness, intrusion prevention, and user identification on top of that. Web content filtering restricts access to harmful or non-business sites based on the destination URL or category.

NIST SP 800-61 and NIST SP 800-86

NIST SP 800-61 defines the incident-response lifecycle: preparation, detection and analysis, containment/eradication/recovery, and post-incident activity. NIST SP 800-86 defines forensic evidence-collection procedures — such as collecting the most volatile data first — along with how to preserve integrity and store evidence. The two complement each other: in the field, SP 800-86's evidence-handling standards are applied within SP 800-61's response workflow.

No-code

Building apps/automation with no code at all—only UI configuration. More limited than low-code but easy for non-developers.

Non-exclusive backup

A backup mode where the backup label is tracked in server shared memory, so even if the session that called pg_backup_start()/pg_backup_stop() (pg_start_backup()/pg_stop_backup() before PostgreSQL 15) crashes, the backup remains safe. Introduced in PostgreSQL 9.6; the older exclusive mode was removed in 15, so this is now the only mode.

Non-functional requirements

Requirements concerning the quality aspects of a system — such as performance, availability, security, and maintainability — rather than the functions themselves. They must be clarified alongside functional requirements during requirements definition.

Non-functional requirements grades

A system and set of tools published by IPA for acquirers and suppliers to concretely agree, as graded levels, on non-functional requirements such as availability, performance/scalability, operability and maintainability, migratability, security, and system environment/ecology. It makes abstract, easily overlooked non-functional requirements visible as items and levels, preventing mismatched understanding of required levels and cost estimates. The architect uses it to elicit non-functional requirements without omission and fix them as premises for architecture design.

Non-overlapping channel

The set of channels in the 2.4 GHz Wi-Fi band whose frequencies do not overlap, typically channels 1, 6, and 11, chosen to avoid interference between channels. Assigning different non-overlapping channels to neighboring access points preserves communication quality.

Non-relational (NoSQL)

Databases storing data flexibly without a fixed schema; four kinds: key-value/document/column-family/graph.

Non-repeatable read

A read anomaly in which reading the same row twice within one transaction returns different values because another transaction updated and committed it in between. It can occur up through READ COMMITTED and is prevented at REPEATABLE READ and above.

Non-repudiation

An extended information-security element ensuring that a party cannot later deny having performed an action or sent a message. It is realized with digital signatures and timestamps that leave verifiable evidence, underpinning the legal traceability of electronic transactions.

NOR flash / NAND flash

Both are non-volatile memory but with different characteristics. NOR flash allows byte-addressable random access and supports execute-in-place (XIP), so it is used mainly for program storage. NAND flash offers higher density and lower cost but is erased/written in blocks, making random access slower, so it is used mainly for data storage. Selection depends on use case, along with design consideration for write-endurance limits.

Normal distribution

A continuous probability distribution forming a bell curve symmetric about the mean, characterized by two parameters: the mean μ and standard deviation σ. Many natural phenomena and measurement errors are modeled as following this distribution; the property that about 68% of data fall within ±1σ of the mean and about 95% within ±2σ is used in statistical estimation and quality control.

Normal forms (1NF to 3NF)

A staged technique for reducing redundancy and update anomalies in relational database design. First normal form removes repeating groups, second normal form separates attributes that depend on only part of the primary key, and third normal form separates attributes that depend on non-key attributes (transitive dependency).

Normalization

Splitting/designing tables to reduce duplication and keep integrity; prevents update anomalies.

Normalization and database design

A design technique that progressively decomposes tables to eliminate redundancy and update anomalies. First normal form (1NF) requires each column value to be atomic (single-valued). Second normal form (2NF) builds on 1NF by removing partial functional dependencies (columns dependent on only part of the primary key), and third normal form (3NF) further removes transitive functional dependencies (indirect dependencies through a non-key column). Database design refers to the overall process of deciding table structure, including this normalization.

Northbound API and southbound API

Names for the direction of an API relative to a controller. A northbound API is the interface a controller exposes upward to applications and automation tools (for example, a REST API), while a southbound API is the interface the controller uses downward to control the devices it manages (for example, NETCONF or OpenFlow).

NotAction

An element used instead of Action that targets everything except the actions listed. Combined with Allow it easily grants unintended broad access, so it is considered safer to use mainly with Deny; the paired NotResource carries the same caution.

NotebookLM

A research aid that summarizes and answers questions grounded in the sources you provide, returning source-based answers.

Notifications connector

A connector that sends push notifications to the Power Automate mobile app; used to alert users of flow results. Its former email-notification action is now retired, so email is sent via a separate connector such as Office 365 Outlook.

Notify function (Power Fx)

Shows a banner message (success/error/info) at the top of the screen; used to notify of saves or input errors.

Notifying users

Mechanisms for communicating with users before or during a session. /etc/issue and /etc/issue.net appear before the login prompt, /etc/motd appears right after login, and wall broadcasts a message to all logged-in users immediately. shutdown warns users before the system goes down.

NPV (Net Present Value)

The sum of a project future cash flows discounted to present value at a given discount rate, minus the initial investment. A positive net present value (NPV greater than 0) indicates the investment is worthwhile, and when comparing multiple proposals the basic rule is to choose the one with the largest NPV. Because it is expressed as an absolute money amount reflecting differences in investment scale, it differs from the payback period method.

NS Record

A DNS resource record that specifies the hostname of an authoritative name server for a zone. NS records placed in the parent zone express delegation to a child zone, and matching NS records within the child zone itself preserve consistency. Unlike an A record used for forward lookup, its essence is indicating where resolution authority resides.

NSG evaluation and effective rules

An NSG can apply to both subnet and NIC, evaluating from lowest priority number and allowing/denying on the first match. Effective security rules show the actual applied result.

NSG security rules

NSG inbound/outbound rules evaluated by priority; allow/deny by source/destination (IP, ASG, service tag), port, and protocol, with default rules evaluated last.

nslookup

A command that queries a DNS server for the IP address corresponding to a given domain name (or the reverse) and displays the result. Used to isolate name-resolution failures and to investigate suspicious domains.

NTP (time synchronization / chrony)

A protocol to synchronize with time sources over the network (UDP 123, pool.ntp.org). Resident daemons ntpd or its successor chronyd (managed with chronyc) slew gradually, avoiding sudden jumps (especially backwards) on live systems; ntpdate is a deprecated one-shot set. Check with ntpq -p / chronyc sources.

NTP stratum

A number expressing time authority (hierarchy of accuracy) in NTP. Servers directly connected to a reference time source such as an atomic clock or GPS are stratum 0/1, and the stratum number increases by one at each hop of servers relaying time onward. Clients prefer servers with a lower stratum value as a more trustworthy time source.

null_frac / n_distinct

Column statistics in pg_stats. null_frac is the fraction of NULL values in the column; n_distinct is the estimated number of distinct values (a positive value is an absolute count, a negative value indicates a ratio relative to row count).

Number column (integer/decimal)

A column storing numbers (integer, decimal, float); usable in calculations and aggregation.

Number of communication channels (n(n-1)/2)

The total number of potential one-to-one communication channels among project participants, calculated as n(n-1)/2 for n people. It quantitatively shows that communication complexity rises sharply as headcount grows, serving as the basis for judging the need for structured communication planning.

Number provisioning (Calling Plan / Operator Connect / Direct Routing)

Ways to obtain Teams Phone numbers: Calling Plan (Microsoft provides numbers and PSTN), Operator Connect (via a certified operator), and Direct Routing (own SBC to an existing carrier).

OAuth (authorization framework)

An "authorization" framework that delegates, as an access token, the permission for a third-party app to access resources on a user's behalf without handing over the password. Note it is not itself an authentication (identity-verification) mechanism; OpenID Connect layers authentication on top.

OAuth App

An integration method that acts on behalf of a user against GitHub. At authorization the user grants a chosen scope, and the app then operates with that user's permissions—so, unlike a GitHub App, it cannot be scoped down per repository with fine-grained permissions. It is also distinct from a PAT (Personal Access Token), a user's own simple token.

Object storage

Virtually unlimited storage that manages data by key and is accessed over HTTP (S3); suited to backups, distribution, and data lakes, with a flat namespace rather than a hierarchy.

Object-level encryption

Encrypts specific columns or objects (cell-level encryption with certificates/symmetric keys). Its granularity differs from TDE, which encrypts the whole database.

Object-level security (Fabric)

Security controlling access at the object level (tables, views, etc.)—a coarser control that hides an entire table, acting as the first gate before finer column- or row-level rules apply. Configured via GRANT/REVOKE in the warehouse.

Object-oriented analysis and design (OOA/OOD)

A methodology that analyzes and designs a system in terms of objects that unite data (attributes) with the procedures (operations) acting on them. Analysis (OOA) models the target domain as classes and their relationships, while design (OOD) makes class structure, responsibility allocation, and collaboration concrete with implementation in view. It leverages encapsulation, inheritance, and polymorphism and uses UML for notation. A system architect uses it to reflect real-world structure naturally and to derive designs resilient to change.

Object-relational mapping (impedance mismatch)

A mechanism that bridges the structural differences (the impedance mismatch) between object-oriented objects and relational database tables and maps the two together. It converts classes to tables, attributes to columns, and references or inheritance to foreign keys, with an object-relational mapper (ORM) automating this conversion. A system architect keeps the object model and data model consistent while judging the mapping strategy against its performance impact.

OCR (Read)

Optical character recognition via Azure AI Vision’s Read, extracting printed and handwritten text from images and documents.

Octal (permission notation)

A base-8 numbering system using digits 0-7; Linux permissions are written as three octal digits summing r=4, w=2, x=1 (rwxr-xr-- is 754).

ODFC (Office Container)

An FSLogix feature that separates only Office/Outlook data (OST, search index, Teams cache) into its own container. Used with Profile Container (which roams the whole profile) to speed up the Office experience.

Office 365 Users connector

A connector to fetch org user profiles (manager, department, contacts); used to determine approvers or show profiles.

Office apps (Word/Excel/PowerPoint/Outlook)

Core apps for documents/spreadsheets/presentations/email; in Microsoft 365 they stay up to date via subscription across web/desktop/mobile with co-authoring.

Office Deployment Tool (ODT)

A command-line tool that finely controls a Click-to-Run installation of Microsoft 365 Apps (Office) via an XML configuration file. It specifies which apps, languages, update channel, and excluded components to include, producing a custom package deployable as an Intune Win32 app or via a distribution share.

Office mobile apps

Mobile apps to use Word, Excel, PowerPoint, and more on iOS/Android.

Offline (air-gapped) backup

A backup kept physically or logically disconnected from the network. A backup that stays continuously connected (an online backup) can itself become a target that ransomware encrypts or destroys, so keeping at least one copy offline (air-gapped) preserves a recovery path even after infection. It is often combined with the 3-2-1 rule (three copies of data, on two types of media, with one copy off-site).

OIDC federation (CI/CD)

A mechanism for external CI (e.g., GitHub Actions) to assume an AWS role without long-lived access keys. Register an OIDC identity provider in IAM, scope the trust policy by sub (repo/branch), and obtain temporary credentials via AssumeRoleWithWebIdentity—keyless and secure.

OLAP (analytical)

An analytical workload of large reads/aggregations over historical data, run against a data warehouse.

OLTP (transactional)

A workload of many small, fast reads/writes for operations; ACID guarantees transaction correctness.

Omnichannel

A strategy that integrates multiple sales and customer-contact channels, such as physical stores, e-commerce sites, mobile apps, and social media, so customers receive consistent information and experience regardless of which channel they use. Sharing inventory, customer data, and purchase history across channels supports behaviors such as trying an item in-store and buying it online. Unlike multichannel, where channels merely coexist, omnichannel emphasizes an integrated experience from the customer's point of view, which is the key judgment point for a strategist choosing between the two.

On-Demand Capacity Reservation

Reserves needed instance capacity in a specific AZ without a long-term commitment—ensuring critical or DR workloads can launch when needed; combinable with Savings Plans for discounts (capacity assurance + cost optimization).

On-premises

Deploying and operating servers and network equipment within an organization's own facilities, as opposed to the cloud. It requires up-front investment and operational effort but keeps data and systems under the organization's own control; combining it with the cloud in a hybrid cloud setup is common.

On-premises data gateway

A bridge required to refresh on-premises (or VNet) data sources from cloud Power BI. Often not needed for cloud SaaS sources.

On-site observation (inspection)

An audit technique in which the auditor personally visits the workplace or system operation site to directly observe the actual conditions. It captures realities that documents or interviews alone cannot reveal, such as adherence to work procedures or the actual state of physical access controls, and because the auditor obtains the evidence firsthand, it carries high reliability.

on: (trigger declaration)

The key that declares the events triggering a workflow—push, pull_request, schedule, workflow_dispatch, repository_dispatch, workflow_call, etc.

One-hot encoding

Converting a categorical variable into 0/1 flag columns, one per category—used for unordered categories (color, region) instead of label encoding (integers, which impose a false order). It increases dimensionality, so for high cardinality consider alternatives (embeddings).

OneDrive

Personal cloud file storage and sync—keep your own files and share as needed (SharePoint is for org sharing).

OneDrive for Business connector

A connector to save/get files in personal cloud storage (OneDrive for Business); used to save attachments in flows.

OneLake

Fabric’s single unified storage per org (ADLS Gen2-compatible; tables in Delta), shared by all experiences to keep data in one place.

OneLake catalog

A data-discovery hub to search and understand OneLake items, checking trust (endorsement) and lineage.

OneLake security

Access control over OneLake data; OneLake data access roles define folder/table-level permissions applied consistently across engines.

OneLake shortcut

References internal/external data (ADLS Gen2, Amazon S3, GCS) from OneLake without copying; avoids duplication and virtually unifies data.

Online vs offline migration

Offline is a bulk copy with downtime; online continuously syncs changes with a final cutover for minimal downtime. Choose by tolerable downtime.

OP25B (Outbound Port 25 Blocking)

A spam countermeasure that blocks direct connections from dynamic IP ranges or general endpoint segments to external port 25 (SMTP). Legitimate mail sending is restricted to the submission port (587) with SMTP-AUTH, preventing direct sending by infected hosts used as relays.

Open API definition (Swagger)

A spec describing a REST API’s operations/parameters/responses, used to define a custom connector. Different role from policy templates (which change runtime behavior).

Open innovation

A management approach that drives innovation by actively incorporating external technologies and ideas from other companies, universities, and research institutions, rather than relying solely on internal resources. It also includes licensing out a firm's own underused technology, and stands in contrast to closed innovation, which relies entirely on internal resources.

Open source (OSS)

A development philosophy of publishing source so anyone can use, modify, and redistribute it.

Open source (OSS)

Software whose source code is published with guaranteed freedom to use, modify, and redistribute (free as in freedom, not price). Not a waiver of rights—it is a copyrighted work imposing terms via a license, provided without warranty and developed continuously.

OpenSearch Serverless (vector engine)

OpenSearch without provisioning that offers k-NN vector search; used as a default vector store for Bedrock Knowledge Bases, retrieving relevant chunks fast via approximate nearest-neighbor search over embeddings. Aurora pgvector or Pinecone are alternatives.

OpenTelemetry

A vendor-neutral standard for instrumenting telemetry (metrics, logs, traces); instrument once and export to many backends, including distributed tracing.

Operating Linux in the cloud

For cloud Linux servers, the provider controls everything outside the OS (power, network entry, physical placement). The management console is internet-reachable, so protect it with multi-factor authentication / one-time passwords (a leak loses every server). Region choice ties to regulation and data sovereignty; ephemeral storage vanishes on stop so keep no durable data there. Design for auto-recovery against provider maintenance (reboots).

Operational level agreement (OLA)

An agreement between operational teams or internal departments within the same organization that sets internal targets to underpin the service levels promised to customers in the SLA. For example, recovery or response times are agreed between internal groups so that their combination meets the SLA target. A service manager derives OLA targets by working back from the customer-facing SLA and aligns internal responsibilities accordingly.

Operations monitoring tools and alerts

Continuous monitoring of server/service liveness, resource utilization, and response times, which raises an alert to administrators when a threshold is crossed or a failure occurs. Tools such as Nagios, Icinga2, Zabbix, Cacti, MRTG, and collectd are used, and many rely on SNMP to poll network device status.

OpEx (operational expenditure)

Spending paid continuously as you consume it. Cloud pay-as-you-go billing follows this model, minimizing upfront investment and letting cost flex with demand. The CapEx-to-OpEx shift is commonly cited as a core financial benefit of moving to the cloud.

Ops Agent

An agent installed on Compute Engine or on-prem VMs that collects detailed system metrics (CPU/memory/disk, etc.) and logs into Cloud Monitoring / Cloud Logging. It unifies the legacy separate Monitoring agent and Logging agent—use this for new deployments.

Optimistic concurrency with ETag

A mechanism using the read-time ETag with If-Match to update only when unchanged, preventing conflicting overwrites. An ETag mismatch returns 412; re-read and retry.

Optimistic locking

A concurrency-control technique that compares a version number or timestamp at update time and lets the write succeed only if no one else has changed the record. It doesn't lock upfront, so concurrency stays high; DynamoDB conditional writes (ConditionExpression) are the classic implementation, with conflicts resolved by retrying.

OPTIMIZE (table compaction)

A Delta maintenance command that compacts small files into larger ones to speed reads; the go-to fix for the small-files problem.

Optimizer (cost-based optimization)

A mechanism that, using statistics (row counts, value distributions, etc.), estimates the cost (I/O, CPU) of each candidate execution plan that would return the same result, and picks the lowest-cost one. Stale or missing statistics can cause it to pick a poor plan, degrading performance.

Option group

A collection of settings that enable engine-specific add-on features (e.g., Oracle Transparent Data Encryption, SQL Server Native Backup). Where a parameter group covers general engine settings, an option group is scoped to plugin-like engine extensions. It applies mainly to engines like Oracle and SQL Server; some engines, such as Aurora (MySQL/PostgreSQL-compatible), don't use the option group concept at all.

Orchestration (Fabric)

Automatically running multiple steps (pipelines/notebooks) combined by order, dependency, and conditions; parameters and dynamic expressions improve reuse.

Orchestration vs. choreography

Two control styles for coordinating microservices. Orchestration has a central conductor (orchestrator) invoke each service in turn to govern the overall flow, which is easy to follow but concentrates dependence on that conductor. Choreography places no central control; each service publishes and subscribes to events and coordinates autonomously, yielding loose coupling but making the overall flow harder to trace.

Org-wide app settings

Tenant-wide settings for the broad allow/disallow of third-party/custom apps—a layer above granular policies. Extensibility = tabs/messaging extensions/in-meeting apps/workflows.

Organization

An organization account that centrally manages members and repositories, with Teams, billing, and permissions.

Organization Policy

A mechanism that inherits and enforces constraints down the resource hierarchy for consistent org-wide rules (e.g., disallow creation outside certain regions); distinct from IAM grants.

Organization roles (owner/member/security manager)

Roles governing the org: the owner (whole-org control), regular members, and carved-out roles like security manager. Owner is powerful—grant sparingly.

Organization service (IOrganizationService)

A .NET SDK API for server-side/plug-in CRUD on Dataverse. Distinct from the client-side Dataverse Web API.

Organizational structure

The form of organization a company adopts to carry out its business. Types include the functional organization, which divides departments by kind of work; the divisional organization, structured into self-contained units by product or region; and the matrix organization, which combines functional and business axes in a grid — chosen according to business strategy and scale.

Organizational Unit (OU)

A unit for hierarchically grouping accounts within AWS Organizations. SCPs apply at the OU level, separating guardrails by environment (prod/dev) or department.

OS command injection

An attack that abuses a vulnerability where a web app runs unvalidated external input as part of an OS command, causing arbitrary command execution on the server. Validating input before passing it to a shell and safely using command-execution APIs are countermeasures.

OS Login

A way to centralize SSH access to VMs via IAM—safer than distributing keys individually.

OSI model (L3/L4/L7)

A reference model dividing communication into 7 layers. On AWS the common ones are L3 (network—IP/routing), L4 (transport—TCP/UDP, NLB), and L7 (application—HTTP, ALB/WAF). Foundational for understanding which layer load balancers and protections operate at.

OSI reference model

A standard model that organizes network communication functions into seven layers — physical, data link, network, transport, session, presentation, and application. Understanding each layer's role helps clarify where a given protocol fits.

OSINT (open-source intelligence)

Threat intelligence obtained by collecting and analyzing publicly available information (websites, social media, registration data, forums). It is also a reconnaissance method for attackers, while defenders use it to understand their own exposure and gather threat trends.

OSPF

A link-state interior gateway protocol (IGP). Each router shares full topology information (LSAs) and selects the least-cost path by summing costs derived from link bandwidth. It scales to large networks via areas and converges quickly on topology changes; its default administrative distance is 110.

OSPF adjacency

The state (Full state) in which two OSPF routers have exchanged LSAs and fully synchronized their link-state databases with each other. Unlike a neighbor relationship that merely exchanges Hellos and stays at 2-Way, only routers with an established adjacency actually exchange routing information. Duplicate router IDs, mismatched Hello/Dead timers, and mismatched area numbers are typical causes that block adjacency formation.

OSPF network types

A classification that changes how OSPF forms adjacencies based on an interface's physical characteristics. On a broadcast network type (like Ethernet), a DR/BDR election takes place; on a point-to-point network type (like a serial link), there is only one possible neighbor, so no DR/BDR election occurs and both routers form a full adjacency directly. A mismatched network type causes Hello-packet parameter mismatches that block adjacency formation.

OSPF route summarization (area range / summary-address)

An OSPF setting that rolls up several specific routes into one summary route, shrinking routing-table size and the scope of recomputation. The area range command is used on an ABR (area border router) to summarize between areas, while summary-address is used on an ASBR (autonomous system border router) to summarize external (redistributed) routes.

OSS (Open Source Software)

Software whose source code is published and that anyone can use, modify, and redistribute under certain license terms. It is often free to use, but typically comes without warranty, so users need to check the license terms before use.

OSS community and ecosystem

The distributed development that sustains OSS: worldwide contributors send patches/pull requests to maintainers (the final gatekeepers). Communication happens on mailing lists (e.g., LKML), forums, and development sites (issue trackers). Distributions integrate upstream projects and deliver them to users.

OSS-DB / PostgreSQL community

The distributed community that sustains PostgreSQL development and discussion. Developers communicate on mailing lists such as pgsql-hackers (feature development and patch discussion) and pgsql-bugs (bug reports); anyone can contribute by filing bug reports or joining discussions.

Outbound rules and SNAT (Load Balancer)

Translates (SNATs) the source address of outbound traffic from backend-pool VMs to the Load Balancer's frontend IP, enabling outbound connectivity for VMs without a public IP. Outbound rules control port allocation—watch for SNAT port exhaustion under heavy outbound load.

Outer join

A join that includes rows from the non-matching side as well, filling the corresponding columns with NULL. It comes in left, right, and full variants, and is used for requirements like "list all customers, including those with no orders."

Outlook on the web

The browser-based Outlook for accessing Exchange Online mail, calendar, and contacts.

Output ownership and licensing

Ownership/responsibility for adopted code rests with the adopting user/org; output may match public code, so mind licensing and use duplication detection.

Overfitting

When a model scores high on training data but poorly on test data (high variance)—it has learned the noise in the training set too well. Mitigated with regularization (L1/L2), dropout, more data/augmentation, or early stopping. One side of the bias–variance trade-off.

Overlay and Underlay

The underlay is the physical switching/routing infrastructure providing basic IP reachability, while the overlay is a logical network built on top of it via tunneling protocols such as VXLAN or GRE. Overlays decouple virtual network segmentation from the physical topology, enabling flexible multi-tenant designs.

OWASP

A nonprofit organization dedicated to improving web application security, and the collective term for the guidance it publishes. Its best-known deliverable, the OWASP Top 10, catalogs the vulnerability classes that occur most often in practice; in the 2021 edition the top entries include A01 Broken Access Control and A03 Injection (which subsumes SQL injection and cross-site scripting (XSS)) — XSS, formerly its own item, was merged into A03, and CSRF is no longer a standalone item; the list is revised periodically. It is widely used as a reference for what application developers should prioritize fixing.

p-value

The probability, assuming the null hypothesis is true, of observing a result at least as extreme as the data actually seen. A smaller value is stronger evidence to reject the null hypothesis (statistical significance), and it's the standard decision criterion in hypothesis tests like A/B testing.

PaaS (Platform as a Service)

Renting a platform to run apps; the provider manages OS/runtime and you focus on app and data (e.g., App Service).

Pacemaker

Cluster software that builds HA clusters for SAP HANA or SAP Central Services (SCS) on Linux, automatically managing resource failover. Combined with STONITH to prevent split-brain.

Package group

A bundle of packages selectable by purpose at install time (e.g., a minimal server set, a desktop environment); can be added later as a unit.

Packages and repositories

Linux software is managed as packages fetched from distribution servers (repositories); a package manager auto-resolves dependencies and handles install/update/remove centrally, working from a local index (package catalog).

Packet capture (Network Watcher)

A Network Watcher feature that captures a VM’s traffic for analysis; used to isolate app-layer issues invisible to NSG checks.

Packet Mirroring

Replicates traffic in full and sends it out-of-band to self-managed IDS/IPS collectors; more precise than sampled VPC Flow Logs. Distinct from inline inspection (multi-NIC NVA) that blocks on the path.

Page (Power Pages)

A single web page composing a Power Pages site—place sections and components to build content, linked via navigation.

Page fault and thrashing

A page fault is an interrupt that occurs when a page needed under virtual memory is not present in main memory; processing pauses while the page is loaded (paged in) from secondary storage. When too many pages are needed at once for the installed memory, page swapping (paging) happens so frequently that the CPU spends most of its time waiting on I/O and throughput collapses—this state is called thrashing.

Page Replacement Algorithm

An algorithm that decides which page to evict from main memory when it is full, in virtual memory management. Common examples are LRU (evicts the least recently used page), FIFO (evicts the oldest loaded page), and LFU (evicts the least frequently used page).

Paginated report

A fixed-layout, print/PDF-oriented report that splits detail-heavy tables cleanly across pages, built in Power BI Report Builder. Different in purpose from an interactive Power BI report.

PAgP (Port Aggregation Protocol)

A Cisco proprietary protocol that auto-negotiates EtherChannel bundling. It serves the same purpose as the open-standard LACP but works only between Cisco devices, with modes desirable (active) and auto (passive).

Pair programming

A technique in which two developers share one workstation, alternating between a 'driver' who writes code and a 'navigator' who reviews design and catches errors in real time. It is an Extreme Programming (XP) practice aimed at improving quality through continuous review while spreading knowledge across the team.

Parallel query (max_worker_processes/max_parallel_workers_per_gather)

The mechanism for splitting query work across multiple processes. max_worker_processes caps the total background workers available server-wide; max_parallel_workers_per_gather caps how many parallel workers a single query can use at once.

Parallel simulation method

A CAAT technique in which the auditor runs the actual input data used by the production system through an independently prepared verification program, then compares the results against the production system's actual output. Unlike the test data method, it uses real production data, allowing verification of the accuracy of processing results under actual operating conditions.

Parallelization and multicore

Parallelization splits work across multiple execution units to run concurrently for speedup. Multicore is the hardware implementation integrating multiple processing cores on one CPU chip, the main platform enabling parallelization. Achievable speedup is bounded by the sequential fraction (Amdahl's law) and inter-core communication overhead.

Parameter Store

A Systems Manager store that holds configuration and secrets (SecureString is KMS-encrypted) hierarchically with versioning, used to centralize app config.

Paravirtualization

A virtualization approach where the guest OS is aware it is virtualized and uses dedicated drivers (such as virtio) to talk to devices efficiently. Compared with full virtualization, which emulates real hardware entirely, it delivers better I/O performance.

Pareto chart

A chart that arranges defect or problem causes as bars in descending order of frequency, with a cumulative percentage line overlaid. Based on the empirical rule that a small number of causes account for most problems (the 80/20 rule), it is an important analysis tool for narrowing down which causes to address first.

Parity bit

A single check bit appended so the total count of 1-bits is even (even parity) or odd (odd parity). It can detect an odd number of bit errors but cannot locate or correct them, and it fails to detect an even number of simultaneous errors.

Partial index

An index built only over rows meeting a WHERE condition (e.g., CREATE INDEX ... ON t (col) WHERE status = 'active'). It makes searches limited to that subset lighter and faster, but is not used for queries outside the condition.

Participating in the ecosystem (bug reports)

Participation can be graduated: use (itself a form of testing) -> advocacy -> bug reports -> docs/translation/patches. A good bug report includes environment (OS/version), expected vs actual behavior, and reproduction steps, filed on the issue tracker. You can contribute without writing code.

Partition

A mechanism for splitting a large table into multiple physical child tables. Partitioning conditions are specified by range, list, or hash (e.g., PARTITION BY RANGE), used to speed up queries limited to a subset of data and to improve maintainability.

Partition (MBR / GPT)

The unit into which a disk is divided; the ledger is the partition table, either legacy MBR (2 TB max, four primary partitions with extended as the workaround) or the mainstream GPT (practically unlimited, paired with UEFI).

Partition design

Splitting data by frequently filtered columns (e.g., date) so queries read only needed partitions; over-partitioning causes small files, so mind granularity.

Partition editing tools (fdisk/gdisk/parted)

Tools to manage partitions: fdisk is the interactive staple (MBR/GPT), gdisk is GPT-only, and parted supports both and scripts well. fdisk -l lists disks and partitions.

Partition key (Cosmos DB)

The property that distributes data into logical partitions; pick a high-cardinality, evenly distributed value to avoid hot partitions and use RU/s efficiently.

Partition key and logical partition

The unit by which Cosmos DB scales horizontally. Items with the same partition key value form one logical partition (up to 20 GB). Choose a high-cardinality key that evens data/throughput; skew causes hot partitions and 429s. Immutable after creation.

Partitioning

A mechanism for splitting one logical table into multiple physical partitions (declarative partitioning: RANGE/LIST/HASH). Partition pruning skips scanning irrelevant partitions, and maintaining large tables — such as quickly dropping old partitions — becomes easier.

Partitioning (S3/data lake)

Splits data into folders by keys like date or region so queries skip irrelevant partitions (pruning), cutting scan and cost.

Partitioning and clustering (BigQuery)

Partitioning splits a table by e.g. date; clustering orders rows by frequently filtered columns. Both reduce scan volume to optimize BigQuery cost/performance.

PartyRock

A learning-oriented playground built on Amazon Bedrock to prototype generative-AI apps with no code.

Pass-through authentication (PTA) / seamless SSO

PTA validates authentication on an on-prem agent, storing no passwords in the cloud; seamless SSO signs in domain-joined PCs on the corporate network without extra prompts. Contrast with PHS, the simplest method that authenticates in the cloud.

passive-interface (OSPF)

An OSPF interface command that stops the interface from sending Hello packets, so it never forms an adjacency, while the network it belongs to is still advertised as a route. It is used on segments where only end hosts are connected and no other router exists, avoiding needless Hello exchange and reducing unnecessary exposure.

Passkeys (Google Workspace)

A phishing-resistant authentication method that verifies identity via a cryptographic key pair bound to a device's biometrics (fingerprint/face) or screen-lock PIN, with no password involved. Google Workspace admins can allow or require passkeys per organizational unit (OU), configuring them as one method under 2-step verification (2SV).

Password attacks (brute-force, dictionary, list-based)

A collective term for attacks that illegitimately determine someone's password. A brute-force attack tries every possible combination of characters in turn. A dictionary attack prioritizes dictionary words and commonly used strings. A list-based (credential-stuffing) attack tries ID/password pairs leaked from other services against users who reuse them. Long, complex passwords, avoiding reuse, multi-factor authentication, and account lockout are countermeasures.

Password policy

Account-wide rules applied to IAM user passwords, enforcing minimum length, character-type requirements, expiration, and prevention of reusing prior passwords. Combined with periodic access-key rotation, it keeps credential hygiene in check.

Password writeback

Reflects a password reset (via SSPR) in the cloud back to on-prem AD, configured in Connect Sync.

Patch compliance

A capability that, after Patch Manager runs a scan or install, aggregates each instance's adherence to the patch baseline's approval rules. It surfaces instances with missing patches and integrates with the Compliance dashboard or Config rules to identify remediation targets.

Patch function (Power Fx)

Creates or updates a record; used to write to a data source without a form.

Patch group

A way to classify instances by the value of a "Patch Group" tag, scoping which patch baseline applies where. It is the operational unit for assigning different patch baselines (e.g., different approval wait periods) to production versus test environments.

Patch Manager

Defines approved patches via patch baselines and applies them fleet-wide within maintenance windows, evaluating patch compliance.

Patent strategy

The strategic design of when and how broadly to file patents on R&D output, and the management decision of whether to disclose an invention, securing advantage through exclusivity, or keep it a trade secret, avoiding disclosure to prevent imitation. Strategists balance exclusivity against diffusion according to business strategy, as in an open-and-closed approach that defends core technology with a dense patent network while licensing related standards to others cheaply or freely in order to grow the overall market.

PATH

An environment variable listing directories searched for command executables; the current directory is not included by convention, so run local scripts as ./script.sh (relative) or by absolute path.

paths / branches filters

Filters narrowing what triggers push/pull_request; paths/paths-ignore by file and branches/branches-ignore by branch, avoiding unneeded runs to save cost.

Payback period method

A method of evaluating an investment by the length of time (in years) required for the cash flows it generates to recover the initial outlay. Although simple to calculate, the plain payback period ignores the time value of money (discounting) and does not reflect large returns that arise after the payback point, so it is best used alongside NPV and IRR. When the time value of money must be considered, a discounted payback period is used instead.

PBR (policy-based routing)

Unlike ordinary routing, which consults the routing table based only on destination address, policy-based routing overrides the next hop or outgoing interface based on conditions (a policy) such as source address, packet size, or application type. Conditions and actions are defined in a route map, letting only specific departments' or applications' traffic be steered onto a different link, for example.

PCF code component

Power Apps component framework for building custom UI controls in TypeScript/JS. Lifecycle init/updateView/getOutputs/destroy, declared in a manifest, distributed via package→deploy→consume. Usable in canvas/model.

PCI DSS, HIPAA, GDPR, FERPA, and FISMA

Legal and industry frameworks that mandate how personal or sensitive data in a particular domain must be handled. PCI DSS is an industry standard for organizations handling credit card data, GDPR is the EU's personal-data protection regulation, FERPA is the US law protecting student education records, FISMA is the US law governing information security for federal agencies, and HIPAA is the US law protecting health information.

PDCA cycle

A method for continuously improving operations or management by repeating Plan, Do, Check, and Act. The key point is not to stop after one cycle: the result of Act feeds into the next Plan.

PDU, frame, and packet

The unit of data exchanged at each layer is called a PDU (protocol data unit), and its name changes by layer: a frame at the data-link layer, a packet at the network layer, and a segment at the transport layer.

Penal Code (obstruction of business by damaging a computer)

A Penal Code provision that punishes obstructing another's business by damaging or tampering with a computer or its electromagnetic records, or by feeding it false information or unauthorized commands so that it fails to operate as intended or operates contrary to its intended purpose. This provision can apply when malware infection destroys systems or tampers with data in a way that disrupts business operations.

Penetration testing

A test that attempts to break into a system using the same techniques and perspective as a real attacker, demonstrating that a discovered vulnerability is actually exploitable and how far the resulting damage could spread. Unlike vulnerability assessment, which exhaustively lists weaknesses, it digs deep into a specific attack path.

Performance Analyzer

A Power BI Desktop feature that measures each visual’s DAX query and display time to find slow visuals; the starting point for tuning.

Performance metrics (IOPS/throughput/bandwidth/latency)

Core vocabulary for performance: IOPS = I/O operations per second (small random access, e.g., EBS io2); throughput = data volume per time (MB/s, large sequential transfer); bandwidth = link capacity; latency = delay per operation. Design and monitor by the metric that fits the workload.

Periodic/continuous backup and PITR

Two Cosmos DB backup modes. Periodic keeps interval snapshots in geo-redundant storage, restored via Microsoft support. Continuous enables point-in-time restore (PITR) to any point within retention (to the second), self-service—strong against accidental deletes/updates. Restore goes into a new account.

Permissions (GRANT/DENY/REVOKE, least privilege)

Grant permissions per securable via fixed/custom database roles and GRANT/DENY/REVOKE. DENY takes precedence; apply least privilege to all securables.

permissions (token scope)

A key declaring the GITHUB_TOKEN’s permissions; default to least privilege (e.g., contents: read) and elevate only jobs needing writes. Grant id-token: write when using OIDC.

Permissions and ownership

Access control per file for three classes (owner, owning group, others) with read (r), write (w), execute (x); shown in the first 10 chars of ls -l. Change the owner with chown and the group with chgrp.

Permissions boundary

A policy that sets the maximum permissions an IAM user/role can have. It does not grant; it limits effective permission to "identity policy ∩ boundary." Used to prevent over-permissioning when delegating administration.

Permissive licenses (BSD/MIT/Apache/MPL)

Permissive licenses and a middle ground: BSD and MIT allow closing modifications with minimal terms; Apache License 2.0 adds explicit patent grants; MPL is file-level copyleft (only modified files disclosed). The public domain claims no copyright.

Persistent Disk

Block storage attached to VMs; choose zonal/regional (redundancy) and standard/SSD by use case.

Persisting jobs after disconnect (nohup/screen/tmux)

Ways to keep work running after logout or a dropped SSH: nohup ignores hangup (SIGHUP); screen/tmux are terminal multiplexers you can detach and reattach.

Personal Access Token (PAT)

A scope-limited token used instead of a password for Git auth (fine-grained recommended).

Personalize visuals

A feature letting viewers change a visual’s type/fields for themselves (without altering the original report). Distinct from automatic page refresh.

Pessimistic locking

A concurrency-control technique that acquires a lock on the target before updating and makes other transactions wait while it's held. It's safer than optimistic locking when contention is frequent, but it reduces concurrency and risks deadlocks. Distributed locks spanning multiple nodes are typically implemented with DynamoDB or similar.

PEST analysis

A framework that organizes four external macro-environmental factors, Politics, Economy, Society, and Technology, to analyze their impact on business strategy. Strategists use it to catch, early, environmental shifts the firm cannot control, such as regulatory change, economic trends, demographics, and technological innovation, as groundwork for identifying the opportunities and threats in a SWOT analysis.

PFS (Perfect Forward Secrecy)

The property that even if a long-term private key (such as a server certificate key) is later compromised, previously recorded encrypted traffic cannot be decrypted. It is achieved by agreeing session keys with ephemeral per-session keys such as DHE/ECDHE, and is satisfied by default in TLS 1.3.

pg_basebackup

A tool that takes a physical base backup from a running cluster over a streaming-replication connection. It is used to bootstrap a standby for replication or to obtain a starting point for PITR, internally relying on the non-exclusive backup mechanism.

pg_cancel_backend()

A function that cancels only the currently running query of the specified backend, while the session itself continues. To disconnect the entire session instead, pg_terminate_backend() is used (the contrasting function).

pg_config

A utility that prints the build configuration of the installed PostgreSQL (install paths, compile options, version, etc.), commonly consulted when building extension modules.

pg_controldata

A utility that displays the control information (the pg_control file) of a database cluster, such as the database state, the latest checkpoint location, and WAL version.

pg_ctl

The utility for controlling the PostgreSQL server process, with subcommands start/stop/restart/reload/status to start, stop, restart, reload configuration, and check status.

pg_ctl promote

A command that promotes a standby to primary so it can begin accepting writes. During failover, the standard practice is to run it on the standby with the least replication lag. The same promotion can also be triggered via the SQL function pg_promote().

pg_hba.conf

The configuration file controlling client authentication. Each line specifies an authentication method (trust, md5, scram-sha-256, peer, etc.) for a connection source (address, database, user); rows are evaluated top-down and the first matching row's rule applies.

pg_isready

A lightweight utility that checks whether a PostgreSQL server is ready to accept connections, returning an exit code indicating its status (accepting, rejecting, no response, or unknown) for health checks.

pg_locks

A system (dynamic) view listing locks currently held or waited on—it reflects the lock manager's live state and is not a cumulative statistics view like the pg_stat_* views. It shows which transaction (pid) holds or requests which kind of lock on which object, serving as the primary source for investigating lock contention and deadlocks.

pg_monitor role

A predefined role that bundles the privileges needed for server monitoring (including pg_read_all_settings, pg_read_all_stats, and pg_stat_scan_tables). Granting pg_monitor to a monitoring-tool account provides least-privilege monitoring access.

pg_receivewal

A dedicated tool that continuously receives and stores just the WAL stream, without setting up a full standby. It serves as an alternative to WAL archiving or for near-real-time WAL backups. Using a replication slot makes the primary retain unsent WAL, so WAL can be received without gaps even across a temporary disconnection.

pg_reload_conf()

A function that immediately applies configuration changes that take effect via SIGHUP, without restarting the server. However, parameters fixed at server startup (PGC_POSTMASTER, e.g. shared_buffers, max_connections) are not applied by a reload and require a full server restart.

pg_resetwal

A utility that resets the WAL and other control information of a database cluster that has become unstartable (e.g., due to corruption), forcing it into a startable state. It is a last resort that can cause data loss and is not used in normal operation.

pg_rewind

A tool that re-synchronizes an old primary as a standby of the new one. It overwrites only the diverged data blocks with the new primary's data since promotion, making it faster than retaking a full base backup. It is the correct procedure for re-folding the old primary in without risking a split-brain from running both primaries at once.

pg_start_backup() / pg_stop_backup()

Functions that start and stop an online backup for PITR (valid in versions 12-14; renamed to pg_backup_start()/pg_backup_stop() and the old names removed in 15). pg_start_backup() notifies the server that a backup is beginning and forces a checkpoint; pg_stop_backup() signals the end of the backup and finalizes the backup label file and WAL.

pg_stat_activity (wait_event_type/wait_event)

A statistics view showing the state of every currently connected session: the running query, its state (state=active/idle/idle in transaction, etc.), plus wait_event_type indicating the category of wait (e.g., Lock) and the more specific wait_event (e.g., transactionid, meaning it is waiting for another transaction to commit or roll back).

pg_stat_all_tables

A statistics view showing table-level access patterns: sequential-scan counts and rows read (seq_scan/seq_tup_read), index-scan counts, row insert/update/delete counts, and the last ANALYZE time (last_analyze/last_autoanalyze) — used to diagnose missing indexes or maintenance frequency.

pg_stat_archiver

A server-wide statistics view (a single row) tallying WAL archiving outcomes: archived_count (cumulative successes), failed_count (cumulative failures), and last_failed_time (time of the most recent failure) — used to catch archive-command failures early, before they cause disk pressure or replication delay.

pg_stat_bgwriter

A server-wide statistics view (a single row) tallying background-writer activity. As of PostgreSQL 17, checkpoint-related statistics (checkpoint counts, durations, etc.) and buffers_backend (blocks written by backend processes) were split out into the new pg_stat_checkpointer view, so pg_stat_bgwriter now retains only buffers_clean (blocks written by the background writer), maxwritten_clean, and buffers_alloc. In PG16 and earlier, checkpoint stats were still part of this view.

pg_stat_database

A view aggregating statistics per database, including cumulative commits (xact_commit), cumulative rollbacks (xact_rollback), deadlock counts, and temp-file usage, giving a picture of overall workload trends for a database.

pg_stat_replication

A replication monitoring view queried on the primary. For each connected standby it shows the WAL send, flush, and replay positions along with the corresponding lags (write_lag/flush_lag/replay_lag), used to diagnose replication delay.

pg_stat_ssl

A statistics view showing whether each backend connection is SSL-encrypted, along with the cipher and protocol version in use. It reflects wire-level SSL status, not encryption of the stored data itself.

pg_stat_statements

An extension that keeps cumulative execution statistics per normalized query string (with literal constants stripped out): call counts, total/average execution time, blocks read, and more — used to identify which queries impose the most load. It must be registered in shared_preload_libraries, and the statistics it exposes as a view can be cleared with pg_stat_statements_reset().

pg_stat_wal_receiver

A replication monitoring view queried on the standby. It shows the state of the WAL stream it is receiving—such as the primary it's connected to, the received LSN, and the connection start time—in a single row, used to check the walreceiver process's status.

pg_statio_all_tables

A statistics view showing the physical I/O breakdown per table: blocks found in the shared buffer (heap_blks_hit) versus blocks read from disk (heap_blks_read), broken out for the table, its indexes, and TOAST — used to spot tables with a low buffer-hit ratio.

pg_statistic

The system catalog holding the per-column statistics the planner uses to choose execution plans, stored in raw internal format. It is refreshed by running ANALYZE; the values are stored as type-dependent arrays and scalars that are hard to read directly, so it's normally accessed via the human-readable pg_stats view.

pg_stats

A human-readable view over pg_statistic, exposing columns such as null_frac (fraction of NULLs), n_distinct (estimated number of distinct values), most_common_vals, histogram_bounds, and correlation (correlation with physical row order) — the columns you inspect when investigating why the planner chose a given plan.

pg_xact

The directory holding the commit log that records whether each transaction ID has committed or rolled back (formerly named pg_clog). If it is corrupted, row visibility can no longer be determined, leading to serious failures.

pgstattuple

An extension that inspects table/index bloat and dead-tuple ratios in detail. The pgstattuple() function measures page utilization, free-space ratio, and dead-tuple ratio, informing decisions about when VACUUM is needed.

Phantom read

A read anomaly in which re-running the same range query twice within one transaction returns a different number of rows because another transaction inserted or deleted rows in between. Under the SQL standard it can occur up through REPEATABLE READ and is prevented at SERIALIZABLE, though some implementations (such as PostgreSQL MVCC or MySQL InnoDB gap locks) prevent it even at REPEATABLE READ.

Phase gate

A review point set at the end of each project phase where deliverables and status are reviewed to decide whether to proceed to the next phase, revise, or terminate. Because it allows investment decisions to be revisited incrementally, it is important for risk control in large projects.

Phase-Locked Loop (PLL)

A feedback control circuit (phase-locked loop) that synchronizes the phase of its output signal to that of a reference signal. Comprising a phase comparator, loop filter, voltage-controlled oscillator (VCO), and divider, it applies this synchronization to multiply or divide a reference clock and generate the operating clock a CPU or peripheral requires. Because it can derive a high-speed internal clock from a low-frequency reference oscillator, it is central to embedded clock design balancing power, cost, and required performance.

Phishing

A fraud technique that lures victims to fake emails or websites impersonating real companies or financial institutions, in order to steal IDs, passwords, or credit card information. Carefully checking the URL and domain is a basic countermeasure.

Physical data independence

The property that changes to the internal schema (storage structures, index placement, etc.) do not affect the conceptual schema. Storage methods and indexes can be added or changed without breaking the logical design above them.

Physical security controls (entry/exit management and tailgating prevention)

Controls that restrict and log entry to server rooms and offices using ID-card or biometric access management, locks, and surveillance cameras. Tailgating (piggybacking) — an unauthorized person entering right behind an authorized one — cannot be stopped by access management alone, so it is prevented with a mantrap (an interlocking double-door that lets only one person through at a time), guard observation, and keeping entrants alert. In addition, anti-passback — rejecting consecutive entries on the same ID or re-entry with no exit record — helps detect card sharing and tailgating.

Pictogram

A display that conveys information or guidance with simple pictorial symbols instead of words. Typical examples are emergency-exit and restroom signs; the benefit is that they can be understood intuitively across language differences. It is one technique of information design for making things easy for many people to grasp.

PID control

A feedback control method that computes a control output by combining three terms — proportional (P), integral (I), and derivative (D) — based on the error between a target value and the current value. The proportional term responds to the present error, the integral term to the accumulated past error (eliminating steady-state offset), and the derivative term to the rate of change of the error (damping rapid swings); tuning the three gains balances responsiveness against stability.

PII masking (generative AI)

A safeguard that redacts—replaces or masks—tokens of personally identifiable information (PII) found in generative-AI inputs, outputs, and logs. Detections from Amazon Comprehend or Bedrock Guardrails' sensitive-information filters mask the relevant spans in prompts, responses, and logs to prevent data leakage and compliance violations.

PIM (Protocol Independent Multicast)

A family of protocols that build multicast delivery trees. PIM-SM (sparse mode) by default delivers to a group over a shared tree rooted at an RP (rendezvous point), switching to a per-source shortest-path tree (SPT) as traffic volume grows, for efficiency. Bidir-PIM uses only a bidirectional shared tree through the RP, keeping state low in environments with many sources.

PIM active assignment

Assigning a PIM role in an always-on (active) state. Permissions are usable immediately with no activation step, but standing high privilege raises audit risk—eligible assignment is generally recommended instead. Active assignments can still carry a start/end time bound.

PIM eligible assignment

In PIM, assigning a role as a candidate (eligible) rather than always-on (active). The user self-activates only when needed, elevating with MFA, a justification, optional approval, and a time-bound expiry. Core to a least-privilege design that avoids standing high privilege.

PIM for Groups

A PIM capability that makes group membership/ownership Just-In-Time, time-bounding group-based access so privileges tied to groups are not standing.

ping / traceroute (reachability and path)

Tools to isolate network faults by layer: ping (ping6) checks reachability via ICMP, and traceroute/tracepath show each router hop to pinpoint where traffic stops; tracepath needs no privileges and probes MTU.

Pipe (|)

Connects the left command's stdout to the right command's stdin (ps aux | grep nginx); stderr does not enter the pipe (add 2>&1 first to include it).

Pipeline agents (Microsoft-hosted/self-hosted)

The compute that runs pipeline jobs. Microsoft-hosted is clean each run and maintenance-free; self-hosted handles special requirements and speed (custom OS/tools, corporate-network reach, GPUs, resident caches).

Pipeline hazards and forwarding

In pipelined execution, a hazard is a dependency between instructions that prevents correct execution; there are data, control, and structural hazards, resolved by inserting stalls when necessary. Forwarding (data bypassing) routes a computed result directly to a dependent instruction before write-back to cut data-hazard stalls, but a load-use hazard (using the result of an immediately preceding load) still needs a one-cycle stall even with forwarding.

Pipeline job

A sequence connecting multiple components as a DAG, passing data between steps. It can be scheduled and monitored.

Pipeline parameters and dynamic expressions

Parameters pass values at runtime, and dynamic expressions build those values; lets one pipeline be reused across environments/targets.

Pipeline processing

A technique that divides instruction execution into stages such as fetch, decode, execute, and write-back, processing the stages of multiple instructions concurrently to increase CPU throughput. Branch instructions and similar cases can cause pipeline hazards.

PITR (point-in-time recovery)

A mechanism that combines a base backup with subsequent archived WAL to restore a database to an arbitrary point in the past, enabling flexible recovery such as rolling back to just before an accidental operation or failure.

PKI and certificate authority

PKI (public key infrastructure) is the overall framework that binds a public key to its owner to prevent impersonation. A certificate authority (CA) issues a digital certificate for a public key and vouches for its validity, allowing keys to be exchanged securely even between parties meeting for the first time.

Placement groups (cluster/spread/partition)

Strategies for physical placement. Cluster packs instances on the same rack for low latency/high throughput (HPC); spread separates them across hardware to avoid simultaneous failure (a few critical instances); partition isolates failures by group (distributed systems like HDFS).

Plan Mode

Has Copilot lay out "what to change and in what order" before implementing, so you agree on a plan first.

Planned value (PV)

The cumulative approved budget authorized for work scheduled to be completed by a given point in time. It serves as the performance measurement baseline against which actual EV and AC are compared to compute schedule and cost variances (SV, CV).

Planner control parameters (enable_*/random_page_cost/hash_mem_multiplier)

Parameters for diagnosing and controlling planner behavior. enable_* (e.g., enable_seqscan) temporarily disables a specific scan/join method to test the planner's decisions — a diagnostic switch. random_page_cost estimates the cost of random I/O, affecting how favorable Index Scan looks (often lowered on SSD-backed storage). hash_mem_multiplier controls how many multiples of work_mem hash-based operations may use.

Planner distribution stats (most_common_vals/most_common_freqs/histogram_bounds)

Distribution statistics in pg_stats. most_common_vals (MCV) lists frequently occurring values, paired with most_common_freqs, their respective frequencies. histogram_bounds gives the boundaries of an equi-frequency histogram for values not in the MCV list, used to estimate selectivity for range predicates (WHERE col > constant).

Planning of service management

The activity of establishing in advance the policies, objectives, scope, required resources, roles and responsibilities, and schedule needed to run service management effectively. It corresponds to the Plan step in the JIS Q 20000 PDCA cycle and forms the foundation for subsequent operation, monitoring, and improvement. A service manager translates business goals and customer requirements into the plan, decides how to allocate limited resources across services, and sets the premises for later processes to operate coherently.

Platform business (two-sided market and network effects)

A business model in which a platform operator intermediates between distinct user groups, such as sellers and buyers, maximizing value for both sides of this "two-sided market." Network effects mean that as one group of users grows, the platform becomes more valuable to the other group, often letting early movers build a durable advantage. IT strategists weigh whether a company can shift from selling products directly to operating a platform that connects many participants, as a lever for business transformation.

Playground

A place to interactively try a deployed language model without code, checking how prompts and parameters behave.

Plug-in Registration Tool

A tool to register plug-in steps (message/table/stage/images) and destinations such as webhooks/Service Bus.

PMBOK

A guide (Project Management Body of Knowledge) organizing the body of knowledge for project management. Through the 6th edition it was structured around 10 knowledge areas (scope, schedule, cost, quality, risk, procurement, stakeholders, etc.) and process groups. Since the 7th edition (2021) it centers on 12 principles and 8 performance domains.

PMF (Protected Management Frames)

A mechanism that encrypts and authenticates wireless management frames (such as deauthentication and disassociation) to prevent tampering. Without it, an attacker can easily send forged disconnect frames as a denial-of-service (deauthentication) attack; WPA3 mandates PMF.

PMO (project management office)

An organizational unit that governs standards, methods, and tools across multiple projects and coordinates governance and resource allocation. It can take forms with varying levels of authority, from supportive to controlling to directive, and is important for ensuring consistency and prioritization of projects across the organization.

Point operations and query operations

A point operation reads/creates/replaces/upserts/deletes one item by id + partition key—cheapest and fastest. A query operation fetches many by criteria with RU depending on the query. Always use point operations when a single item is known.

Point-in-time restore (PITR)

Restores to any point within the retention window (default 7 days, max 35) as a new DB, using automated full/differential/log backups.

Point-to-point (VPN connection type)

A VPN connection type linking a single client to a single site (or server) one-to-one, as configured with tools like OpenVPN. It differs from site-to-site, which links multiple sites together.

Point-to-site VPN (P2S)

Connects individual client devices to an Azure VNet; choose a tunnel type and authentication (certificate, RADIUS, Microsoft Entra ID) and distribute a VPN client configuration.

Policies (member capabilities)

Org/enterprise settings governing what members can do (repo creation, visibility, forking, Actions usage, enabling GHAS, etc.). Enterprise policy cascades to lower orgs/repos—a separate layer from rulesets (guardrails on code changes).

Policy assignment

Assigning Teams policies to users or groups (group assignment auto-rolls out). Distinct from a policy package (a predefined bundle).

Policy Intelligence

Tools (e.g., IAM Recommender) that find granted-but-unused over-privilege from usage and recommend minimization, supporting continuous least privilege.

Policy packages

Predefined bundles of multiple Teams policies tailored to a role (education, healthcare), applied together. Distinct from policy assignment (applying to users/groups).

Policy template (custom connector)

A mechanism to change a custom connector’s runtime behavior (set/transform headers/URL/parameters) without code.

Policy-based vs route-based VPN

Policy-based fixes targets via traffic selectors (static; single S2S); route-based is flexible via routing (needed for P2S, multiple connections, coexistence)—usually preferred.

Polling vs. webhook (push/pull)

Two integration styles. Polling (pull) periodically queries (simple but adds latency/waste); webhooks (push) call you on events (immediate, efficient, but the receiver must be available). On AWS, EventBridge/SNS are push; SQS receive is pull.

Polyglot persistence

The idea of using the data store best suited to each kind of data: a relational database for business data needing strong consistency and joins, a key-value store for simple high-speed lookups, a document database for hierarchical documents, and a graph database for traversing relationships. Instead of forcing everything into one database, the architect accepts the trade-off of maintaining consistency across stores and higher operational cost.

Port and process inspection (nmap/lsof/fuser)

nmap scans ports from outside to see the real exposure; lsof (lsof -i:80) and fuser identify the process holding a port or file. The difference between ss (inside) and nmap (outside) is the firewall effect.

Port mapping (Docker)

A mechanism that maps a container's internal port to a port on the host, specified with docker run -p host:container. External traffic to that host port is then forwarded to the service inside the container.

Port number

A 16-bit number identifying which service is running on a given IP address (e.g., HTTP uses 80, HTTPS uses 443, SSH uses 22). Carried in TCP/UDP headers, and firewall/security-group rules allow or deny traffic based on source/destination port.

Port redirection

A mechanism that forwards traffic destined for one port to a different port or host, implemented via constructs such as the iptables NAT table (DNAT); commonly used to route an externally exposed port to an internal service.

Port scan

A reconnaissance technique that sends packets to a target host's ports and infers, from the presence or content of the responses, which ports are open (have a running service). Attackers use it to survey targets and identify vulnerable running services; techniques such as TCP SYN scans that never complete a full connection are harder to detect. IDS/IPS and log monitoring detect it as an anomalous spike in connection attempts per unit time.

Port security

A switch feature that sets, per port, a maximum number of learned/allowed MAC addresses or specific permitted MACs, and shuts the port down or drops frames when the limit is exceeded or an unauthorized MAC is seen. It prevents MAC address table overflow (MAC flooding) attacks that flood the table with forged source MACs.

PortFast

A Cisco feature applied to access ports connecting only end hosts (like a PC) that skips STP's listening/learning states and moves straight to forwarding, eliminating delays such as a DHCP client timing out while waiting for STP convergence. It must never be enabled on ports connecting to another switch, which risks a loop.

POS system

A point-of-sale (Point Of Sale) system that records product codes, quantities, and the time of sale at the moment a product is sold at the register, and uses that data for inventory management and sales-strategy analysis.

Positional parameters ($# / $@ / shift)

Special variables for a script arguments: $0 is the script name, $1..$n each argument, $# the argument count ($0 excluded), $*/$@ all arguments; shift moves them left by one.

Post Image (plug-in)

A snapshot of a target record's column values after an operation (after a Create or Update executes), configured on a Dataverse plug-in registration step. Used when plug-in logic needs to reference values that didn't exist before the operation, such as platform-generated IDs or calculated columns.

Post-processing

The stage after the model generates that formats output and removes unneeded/inappropriate results before returning the final suggestion.

PostgreSQL

An open-source object-relational database management system (ORDBMS) led by the PostgreSQL Global Development Group and distributed under the permissive PostgreSQL License (similar to BSD/MIT). The subject product of the OSS-DB Silver/Gold exams.

PostgreSQL License

The permissive license applied to PostgreSQL itself. Similar to BSD/MIT-style licenses, it freely allows modification, redistribution, and commercial use as long as the copyright notice and disclaimer are retained. It has no copyleft clause.

PostgreSQL process architecture (postmaster/backend/background)

PostgreSQL's process architecture: the postmaster is the parent process started first, handling connection acceptance and process management. A backend is a child process forked per client connection. Background processes (autovacuum launcher, WAL writer, checkpointer, etc.) handle server-wide auxiliary work.

postgresql.conf

The main configuration file for server-wide operating parameters, setting listen_addresses (listen address), port (listen port), max_connections (max connections), and logging_collector/log_destination (log output method). It supports an include directive to pull in other files.

Power Apps

A low-code tool to build business apps (act); canvas apps (UI-first, free design) and model-driven apps (Dataverse data-first, auto-generated layout).

Power Apps component framework (PCF)

Lets pro developers build custom controls (code components) in code and add them to canvas/model-driven apps; a hallmark of fusion development.

Power Apps Mobile

A mobile app (iOS/Android) to run published canvas/model-driven apps; can use device features like camera and location.

Power Apps Studio

The browser-based editor for building and editing canvas apps—arrange screens, controls, data sources, and Power Fx formulas.

Power Automate

A tool to automate repetitive work (automate); a flow = trigger + actions; cloud flows (automated/instant/scheduled) and desktop flows (RPA, UI actions).

Power Automate for Desktop

The Windows app to build and run desktop flows (RPA), automating UI actions via recording and action steps.

Power Automate Mobile

A mobile app to run flows, respond to approvals, and check notifications from a phone; also triggers button flows.

Power BI app

A mechanism to distribute workspace content as an organized package to many viewers. Choose vs individual sharing (a few) or workspace roles (development).

Power BI components (Power Query/model/visuals)

In Power BI Desktop, Power Query ingests and shapes (cleanses) data → build a data model (relationships, measures) → construct reports with visuals, then share via the Power BI service.

Power BI Desktop project (.pbip)

A format that saves report and model as text-based files; easy to source-control in Git for diff review and CI/CD.

Power Fx

Power Platform’s declarative, Excel-like formula language for low-code logic, used mainly to express canvas-app behavior; easy to learn and reusable.

Power Pages templates

Prebuilt site templates for common uses (event registration, contact, FAQ); publish quickly instead of starting from scratch.

Power Platform admin center

The admin portal to centrally manage environments, capacity, DLP policies, analytics, and settings, including per-product (Power Apps/Automate) administration.

Power Platform Build Tools

CI/CD tools to automate export/import/test in Azure DevOps/GitHub Actions. Distinct from Pipelines (in-platform transport).

Power Platform CoE Starter Kit

A Microsoft-provided set of templates to monitor and govern tenant-wide Power Platform use (CoE = Center of Excellence); inventories apps/flows and automates governance.

Power Platform Pipelines

Automates solution transport dev→test→prod within Power Platform. Different location from Build Tools (CI/CD in Azure DevOps/GitHub).

Power Query

Power BI’s data-prep engine to get data from sources and clean/shape it (remove columns, change types, merge); steps are repeatable.

Power saving

Techniques for reducing a device's power consumption — for example, automatically switching to sleep mode when idle or lowering screen brightness. It extends battery life and lowers electricity cost and environmental impact, and is especially important for battery-powered IoT devices.

Power/interest grid

An analysis tool that maps stakeholders on two axes, power (degree of influence) and interest (degree of concern in the project), to determine engagement strategy. Stakeholders high on both power and interest require close management, and this grid is the basis for deciding where to allocate limited communication effort.

PowerShell

A command-line shell and scripting language that originated on Windows and is now cross-platform (PowerShell 7 also runs on macOS/Linux). It is powerful for automating administration, but because it is a legitimate built-in tool, attackers who have already gained a foothold often abuse it too (living off the land), making execution policy and logging important controls.

PPM (Product Portfolio Management)

A method that classifies a company's products or businesses into "stars," "cash cows," "problem children," and "dogs" along two axes — market growth rate and market share — to guide the allocation of management resources.

Pre Image (plug-in)

A snapshot of a target record's column values before an operation (before an Update or Delete executes), configured on a Dataverse plug-in registration step. Used to detect what changed by comparing to pre-update values, or to capture pre-delete data for an audit log. A Create operation has no Pre Image, since there is no prior state.

Pre-loading

Fetching data at canvas app start to improve perceived performance. Different purpose from delegation (source-side processing).

Precedence diagramming method (PDM)

A schedule network diagramming technique that represents activities as nodes (boxes) connected by arrows showing precedence relationships. Because it needs no dummy activities and can directly express all four dependency types (FS/SS/FF/SF), it is the standard technique used in modern project scheduling.

Precedence relationship (FS/SS/FF/SF)

The type of sequencing constraint between activities: finish-to-start (FS), start-to-start (SS), finish-to-finish (FF), or start-to-finish (SF, rare), with FS being most common. Correctly expressing these dependencies in the schedule network diagram is the basis for computing the critical path.

Predictive / adaptive lifecycle

A predictive (waterfall-style) lifecycle fixes scope, schedule, and cost early and proceeds sequentially, while an adaptive (agile-style) lifecycle assumes requirements will change and proceeds iteratively and incrementally. Judging which lifecycle to choose, based on requirement certainty and pace of change, is an important decision point.

Preemption

A mechanism by which the scheduler forcibly suspends the currently running task and switches to a higher-priority task the moment that task becomes ready. It ensures prompt response to urgent work, but requires careful protection of critical sections so the preempted task is not interrupted while resources are in an inconsistent state.

Premium connector

Connectors to advanced targets (some SaaS, SQL, Dataverse, custom APIs) that may require a premium license; standard connectors are included in many plans.

Preparing for a dimensional model

Shaping data into facts (measures) and dimensions (attributes), loading with surrogate keys and support for slowly changing dimensions (SCD).

Prevention-first and gate-based

Prevention-first keeps problems from entering at the source (e.g., Push Protection). Gate-based blocks vulnerable items via required checks before merge/deploy (required Code Scanning/Dependency Review). Not exclusive—combine in layers.

Pricing models (On-Demand / Savings Plans·RI / Spot)

On-Demand = pay-as-you-go, most flexible; Savings Plans/RI = discount for a 1–3 year commitment; Spot = spare capacity up to ~90% off (interruptible).

Primary key

A column that uniquely identifies each row; no duplicates or nulls.

Primary key and foreign key (relational DB)

A primary key is the column (or combination of columns) that uniquely identifies a row within a table. A foreign key is a column that references another table's primary key, implementing the relationship between tables.

Primary metric

The metric a sweep or AutoML optimizes against (e.g., accuracy, AUC), with a direction to maximize or minimize.

Principal

The actor that performs an action in IAM—an IAM user, role, AWS service, another account, or a federated identity. It is what a Principal element in a resource-based or trust policy names when specifying who is granted access.

Principal component analysis (PCA / dimensionality reduction)

A dimensionality-reduction method that compresses many correlated features into a few synthetic axes (principal components) maximizing variance—used for visualization, noise reduction, and cutting compute. Unsupervised, with reduced interpretability; t-SNE/UMAP are non-linear alternatives for visualization.

Principle of least privilege

A design principle that grants each identity (person, app, or service) only the minimum permissions needed to do its job. Excess privilege widens the blast radius of a mistake or breach, so it is continuously tightened through IAM roles, policies, and permission boundaries.

Principle of least privilege and RBAC

The principle of least privilege grants users only the minimum access needed for their duties; RBAC (role-based access control) implements it by assigning permissions to job roles rather than to individuals. This makes it easier to review access on transfer or departure and limits the risk of over-provisioned privileges.

Priority inheritance / priority ceiling protocol

Two remedies for priority inversion. Priority inheritance temporarily raises the priority of the low-priority task holding a lock that a high-priority task is waiting for, up to the waiting task's level, so it cannot be preempted by a medium-priority task. The priority ceiling protocol instead pre-assigns each shared resource a ceiling equal to the highest priority among all tasks that might use it, and immediately raises the locking task to that ceiling — a simpler implementation that also prevents deadlock as a side effect.

Priority inversion

A phenomenon in which a high-priority task, while waiting for a shared resource lock held by a low-priority task, keeps losing the CPU to a medium-priority task — so the high-priority task is effectively delayed behind the medium-priority one. It is a serious cause of missed deadlines and must be addressed with priority inheritance or priority ceiling protocols.

Priority Scheduling (Strict Priority / WFQ)

Strict priority queuing (PQ) always services the highest-priority non-empty queue first, minimizing delay and jitter for high-priority traffic but risking starvation of lower-priority queues under sustained high-priority load. Weighted fair queuing (WFQ) instead services multiple queues in proportion to assigned weights, guaranteeing each queue a minimum bandwidth share and preventing starvation while still differentiating priority.

Private / public IP address

Private IP addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) are numbers used only within a limited scope such as an organization and cannot reach the internet directly. They pair with public IP addresses, which are uniquely reachable on the internet, and a router translates between the two to communicate.

Private Address

IPv4 address ranges defined by RFC 1918 for use solely within private organizational networks (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). They are not routed on the public Internet, so external communication requires NAPT translation to a global address.

Private cloud

A cloud dedicated to one organization, built in-house or in a dedicated host, with control kept in-house.

Private clusters and authorized networks

GKE security design: private clusters keep nodes private without external IPs, and authorized networks (or a DNS-based endpoint) restrict which source IPs can manage the control plane.

Private DNS zone

A DNS zone valid only inside VNets; link it to a VNet to resolve internal or privatelink names to private IPs—key to operating private endpoints.

Private endpoint

A NIC with a private IP in the VNet that connects to PaaS (Storage/SQL) without the public path; each sub-resource needs its own endpoint and DNS zone.

Private Google Access

A setting that lets VMs without external IPs reach Google APIs (e.g., Cloud Storage) privately; distinct in purpose from general egress via Cloud NAT.

Private IP ranges (RFC 1918)

Private address blocks not routed on the internet: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16. VPC CIDRs are typically chosen from these; when connecting multiple VPCs, avoid overlapping ranges (overlap breaks peering/TGW reachability).

Private Link and DNS integration

Points the PaaS public FQDN via CNAME to a privatelink zone and resolves it to the private IP through the private DNS zone’s A record; forgetting this resolves to the public IP—a common incident.

Private NAT

A mechanism to reserve NAT addresses for egress/private connectivity without consuming internal RFC1918 ranges; used to avoid IP exhaustion and overlap in large environments.

Private Service Connect

A way to reach specific managed/published services over private IPs without traversing the internet; use it to avoid exposing public IPs.

PrivateLink endpoint service

Exposes your own service behind an NLB privately to other VPCs/accounts via PrivateLink; traffic stays inside AWS, enabling SaaS-style offerings without the internet or VPC peering.

Privilege escalation

The act of an attacker or malicious process illegitimately gaining more privilege than it was granted, such as escalating from a normal user to an administrator. It typically exploits an OS or application vulnerability or a misconfiguration, and is high severity because it grants control over the whole system afterward.

Privileged Access Manager (PAM)

Grants high privileges only when needed via approval with automatic expiry instead of standing grants, reducing the attack surface by avoiding standing privilege.

Privileged Access Workstation (PAW)

A design allowing admin operations only from dedicated hardened devices with email/browsing removed, preventing credential theft via a compromised admin endpoint. Isolates the "admin entry point" that MFA/PIM alone cannot protect.

Privileged ID management

A framework that separates privileged IDs holding system-administrator rights (root/Administrator, etc.) from ordinary user IDs and strictly manages their request, approval, issuance, usage logging (audit trail), and return. Privileged access management products automate password rotation or one-time issuance to reduce the risk of shared or permanently held credentials.

Proactive problem management

The aspect of problem management that finds and removes potential causes before incidents occur, preventing them proactively. It identifies weaknesses through trend analysis of past incidents and analysis of monitoring data, taking countermeasures in advance. It is the counterpart to reactive problem management, which responds after incidents happen.

Proactive remediations

An Intune feature named Remediations (formerly Proactive remediations, managed under Endpoint Analytics' Scripts) that pairs a detection script with a remediation script to auto-detect and auto-fix common issues (low disk space, a stopped service, etc.). The remediation script runs when the detection script's exit code is non-zero (failure); you can schedule the run and assign it by device group with RBAC. It's an execution counterpart to Endpoint Analytics' visualization, forming a detect-then-fix loop.

Probabilistic generation

The LLM trait of generating output probabilistically; output can vary for the same context and isn’t always optimal (not a bug).

Probability and impact matrix

A qualitative risk analysis technique that maps risks onto a grid based on probability of occurrence and impact severity to determine priority (high/medium/low). It is the basis for deciding which risks limited response resources should be prioritized against.

Probability and statistics

A field that captures the tendencies and uncertainty in data numerically. It includes correlation (the strength of the relationship between two data sets), regression (approximating a trend with a formula), and the normal distribution (a bell-shaped curve symmetric about the mean); it forms the basis of data analysis and quality control.

Problem management

The process that identifies the root cause (the problem) behind one or more incidents and pursues permanent resolution and prevention of recurrence. It has a reactive side (responding to incidents that have occurred) and a proactive side (preventing them through trend analysis). Unlike incident management, which seeks fast recovery, its focus is on eliminating causes.

Procedural language PL/pgSQL (functions, procedures)

PL/pgSQL is PostgreSQL's built-in procedural language, allowing functions and procedures to be written with control structures (IF, loops, etc.). Functions return a value and can be used inside queries, while procedures execute a sequence of operations—including transaction control—invoked with CALL.

Process / PID

A process is a running instance of a program, identified by a unique PID. The first to start, PID 1, is systemd (init).

Process advisor

A Power Automate capability that records your actions (task mining) to analyze time and steps and find what to automate; the counterpart to process mining.

Process groups

The five groupings of project management activities defined in JIS Q 21500: initiating, planning, implementing, controlling, and closing. They are not simple chronological phases but can overlap and iterate within a project (e.g., planning and implementing repeat). Combined with the subject groups (knowledge areas) in a matrix, they form the framework for organizing which process belongs to which knowledge area.

Process Mining

A Power Automate capability that ingests event logs from real systems to visualize and analyze how processes actually run, finding bottlenecks and automation opportunities.

Process monitoring (top / ps / pstree / uptime)

Commands to inspect running processes and load: top shows live CPU/memory leaders, ps a snapshot (ps aux), pstree the parent-child tree, uptime the uptime and load average.

Process-oriented approach (POA)

A methodology that analyzes and designs information systems centered on business processing functions. Functions are decomposed step by step with tools such as data flow diagrams (DFDs), and the inputs and outputs each function handles are defined. Data structure tends to be dragged along by changes in functions, which can hurt maintainability, so it is contrasted with the data-oriented approach (DOA) that treats data structure as a stable base. A system architect chooses between them according to the nature of the target business.

Procurement (planning and execution)

A series of activities for selecting and obtaining what is needed in order to outsource work such as system development to external vendors. First a 'plan' is drawn up to decide what to procure and how, then 'execution' follows, choosing a supplier and contracting through means such as an RFI (Request for Information), RFP (Request for Proposal), and competitive quotations.

Product backlog and sprint backlog

The product backlog is a prioritized, continuously refined list of everything needed for the product, owned by the Product Owner. The sprint backlog is the subset selected for the current sprint plus the Development Team's plan for delivering it. They differ in scope (whole product vs. one sprint) and in who owns them.

Product innovation and process innovation

Product innovation creates a new product or service itself, while process innovation improves the methods and workflow used to produce or deliver an existing product, raising efficiency or cutting cost. Strategists judge where to place investment emphasis according to the business's life-cycle stage, favoring product innovation for differentiation early on and process innovation for cost competitiveness as the business matures.

Product Liability Act (PL Act)

A law providing that when a defect in a product causes harm to life, body, or property, the manufacturer bears liability for damages regardless of fault, that is, strict, no-fault liability. Victims do not need to prove negligence on the part of the manufacturer; it suffices to prove the product had a defect, that damage occurred, and the causal link between them, making the framework more likely to hold manufacturers responsible. Software by itself generally falls outside its scope, but the law can apply to defects in hardware products in which software is embedded.

Product life cycle (PLC)

A framework that views a product's market life in four stages: introduction, growth, maturity, and decline. Because sales, profit, and competitive intensity differ at each stage, strategists make stage-appropriate decisions: investing to build awareness during introduction, expanding share during growth, differentiating or extending into related products during maturity, and harvesting or withdrawing during decline.

Product Owner and Scrum Master

Two of the three accountabilities that make up a Scrum Team. The Product Owner is accountable for managing the product backlog and maximizing value — deciding "what" to build. The Scrum Master is a facilitator who establishes Scrum and removes impediments. The remaining accountability, the Developers, decides "how" to build (the implementation). The exam point is that no single manager issues top-down orders.

Production environment

An environment for production apps/flows; backed by Dataverse and typically created per purpose or team.

Products and subscriptions (APIM)

Bundles APIs as "products" that consumers use via subscriptions (keys); manages exposure and terms per product.

Professional ethics and professional skepticism

Professional ethics is the code of conduct auditors must uphold — integrity, objectivity, competence, and confidentiality. Professional skepticism is the auditor's mindset of not simply accepting explanations or evidence from the audited unit at face value, but critically examining them for inconsistencies or deficiencies. Together they underpin the reliability of audit conclusions; even an independent auditor who lacks skepticism can miss material weaknesses.

Program management

A management discipline that bundles multiple related projects and coordinates their interdependencies and resource allocation toward a business goal that no single project could achieve on its own, aiming for overall optimization. While individual project management focuses on "doing things right" within a defined scope, program management requires judging whether the projects together are "doing the right things" to realize business strategy. IT strategists oversee multiple systemization initiatives as a single program, continually checking their alignment with management goals.

Programming language and markup language

A programming language is an artificial language for instructing a computer on how to process something (C, Java, Python, etc.). A markup language uses symbols (tags) to specify a document's structure or appearance; HTML for describing web pages and XML for data exchange are typical examples. They differ in role: writing processing logic versus indicating structure.

Programming paradigms (procedural, functional)

Basic philosophies for structuring programs. The procedural paradigm describes a sequence of steps (a series of commands) to be executed in order. The functional paradigm views computation as "applying mathematical functions" and avoids side effects that change external state, building programs by composing pure functions that always return the same output for the same input. Together with object orientation these form the three major paradigms.

Project charter

A document that formally authorizes a project and grants the project manager authority to apply organizational resources. It records the purpose, high-level scope, assumptions, and key stakeholders. It formalizes project initiation and serves as the basis for subsequent planning.

Project management knowledge areas

A way of organizing the aspects a project must manage to proceed in a planned manner. They include scope management (defining the work), schedule management (setting timelines), cost management (controlling spending), quality management (maintaining deliverable standards), risk management (preparing for possible problems), and stakeholder management (aligning the expectations of those involved), combined to coordinate the whole project.

Project scope statement

A document that details a project deliverables, boundaries, exclusions, and acceptance criteria. It is the basis for creating the WBS and clarifies to all parties what is and is not included, helping prevent scope creep.

Prompt and completion

Prompt = the input (instruction/question) to the model; completion = the generated output.

Prompt caching

A caching technique that skips recomputing common prefixes (e.g., system prompts) to lower token cost and latency—distinct from semantic caching, which reuses results for semantically identical queries.

Prompt engineering

The lightest way to improve output by crafting instructions, examples, and roles (system prompt); includes zero-shot/few-shot/chain-of-thought.

Prompt file

A file of reusable standard instructions for consistent Chat responses; distinct in use from always-applied instructions files.

Prompt flow

A development tool that links LLMs, prompts, Python, and tools as nodes to build, evaluate, and deploy generative-AI app flows. Chaining logic is defined with the SDK.

Prompt flow (Foundry)

A development feature linking LLMs, prompts, Python, and tools as nodes to build, evaluate, and deploy generative-AI flows, used to implement RAG and agents.

Prompt flow CI/CD

Treats prompt flow as code, building pipelines with evaluation-gated automated testing, approval, and deployment to iterate generative-AI apps safely.

Prompt governance

Governing prompts as managed assets: template, version, and deploy (aliases) them via Bedrock Prompt Management, constrain deviations with Guardrails, and audit API operations/access via CloudTrail/CloudWatch Logs—making it traceable who used which prompt version and when.

Prompt management

A capability for admins and users to save, share, schedule, and delete frequently used prompts to reuse and standardize them across the org.

Prompt regression testing / deployment validation

Validation that prevents quality regressions from generative-AI changes (prompt, model, RAG): expected-output checks, edge cases, synthetic flows, and quality gates built into CI/CD, blocking release on regressions. Combined with A/B and canary for staged rollout.

Prompt shields and harm detection

Prompt shields detect jailbreak and indirect prompt-injection attacks, and protected-material detection guards against misuse and leakage in generative AI.

Prompt templates

Defining prompts as templates with insertable variables, assembled dynamically from inputs to improve reuse and consistency.

Prompt variants

Defining and tracking multiple prompt versions for the same goal, comparing them via manual evaluation or metrics to pick the best wording.

Protected actions

Protection that blocks the most dangerous admin operations (e.g., deleting Conditional Access policies) unless a strong authentication context (e.g., phishing-resistant MFA) is met. Adds a stricter gate than ordinary role permissions.

Prototyping

A development model that builds a trial version (prototype) early in development and has users review it to validate the requirements. It lets stakeholders agree on requirements that are hard to convey in words, such as screens and usability, reducing misunderstandings and rework early. A system architect chooses this approach when requirements are vague and uncertainty is high, deciding the scope of the prototype and whether it is throwaway or evolutionary.

Provisioned throughput optimization

Operating Bedrock provisioned throughput (reserving model units for stable capacity) efficiently: monitor utilization and reserve for peaks while shifting off-peak to on-demand. Cheaper for steady high load; on-demand wins for sporadic load.

Provisioned vs. serverless

A capacity-model contrast. Provisioned reserves capacity ahead (predictable, steady load—can be cheaper); serverless auto-follows demand, pay-per-use, no capacity management (intermittent/unpredictable load). A choice across Aurora, DynamoDB, Lambda, etc.

Provisioning logs

An Entra log recording results of auto-provisioning (create/update/delete of users) to SaaS apps. Differs in purpose from audit logs (directory changes) and sign-in logs (authentication events).

Proximity placement group (PPG)

An Azure placement feature that co-locates VMs physically to minimize app↔DB network latency, used to meet SAP latency requirements. Different purpose from availability zones (DC-failure tolerance).

Proxy filtering

The stage in the path to the model that filters harmful content, vulnerable patterns, and (per settings) public-code matches; not perfect.

Proxy server

A general term for a server that sits between clients and servers, relaying requests. Depending on placement, it acts as a forward proxy (client side) or a reverse proxy (server side); Squid is a common implementation.

Pseudocode (Subject B)

A language-independent notation used in Subject B of the FE exam. It expresses variable declarations, branching, loops, and function calls in a common syntax, and is used to test tracing algorithms and filling in blanks.

Pseudonymized information and anonymized information

Both are processing categories under the Act on the Protection of Personal Information, but they serve different purposes. Pseudonymized information is processed so the individual cannot be identified unless cross-referenced with other data; it is intended for internal analytical use, with some relaxed restrictions on using it for other purposes without consent, but third-party provision is generally prohibited. Anonymized information is processed so the individual cannot be identified and the data cannot be restored, allowing it to be provided to third parties without consent.

PSI and intellectual property (IP)

Classifications of data that must be protected on a network. The exam lists PII (personal data), PHI (health data), PSI, and IP (intellectual property). PSI is a category for highly sensitive information; its acronym expansion is not standardized across materials (variously given as personal security information or payment-related information). When payment card data is involved, the precise term is the cardholder data (CHD — the PAN card number, expiry, etc.) that PCI DSS governs. IP (intellectual property) is intangible assets an organization holds rights to — patents, trademarks, trade secrets, and proprietary technical information. All carry major impact if exposed, and so are subject to classification, access control, and encryption.

psql

The standard interactive terminal (command-line client) for PostgreSQL. Besides executing SQL statements, it supports backslash-prefixed meta-commands to inspect catalog information and change display settings.

psql meta-commands

Special backslash-prefixed commands inside psql: \l lists databases, \dt lists tables, \du lists roles, \c switches connection, \? shows help for meta-commands, \h shows help for SQL syntax, and \timing toggles display of statement execution time.

PTP (Precision Time Protocol)

A time-synchronization protocol defined by IEEE 1588. Whereas NTP is software-based and accurate to roughly the millisecond, PTP uses hardware timestamping support to achieve microsecond-to-nanosecond precision, and is used where clock drift directly affects the business, such as precision measurement or mobile radio backhaul.

Pub/Sub

A messaging service that ingests events in real time and distributes them to multiple services; used for streaming ingestion.

Public / private subnet

A public subnet has a route to an internet gateway (IGW) for direct external traffic; a private subnet has no IGW route and reaches out via a NAT gateway. Best practice: place only public-facing resources in public subnets.

Public cloud

A shared cloud owned/operated by a provider (e.g., Azure); start immediately with no up-front investment.

Public IP prefix

Reserves a contiguous range of public IPs to stabilize firewall allow-lists; you can also bring your own IP range (BYOIP).

Public IPv4 address behavior

A standard auto-assigned public IPv4 address is dynamic and can change whenever the instance is stopped and started. To keep it fixed, a separately allocated, remappable Elastic IP is required (Elastic IP itself is a distinct concept).

Public-key cryptography (asymmetric)

Encrypt with a public key and decrypt with a private key (or sign with the private key and verify with the public key). It solves key distribution and underpins TLS, SSH, code signing, and certificates; slower than symmetric, so data is encrypted with a symmetric key that is itself protected by the public key (envelope).

Pull Request (PR)

A proposal to merge a work branch (compare) into the default branch (base), merged after review and checks.

Pull Request summaries

Auto-summarizes changes to speed up the start of review; it does not replace human review.

Pull-up resistor

A circuit that connects an input pin to the supply voltage through a resistor, holding it at a High level unless something externally pulls it Low. It is used with open-drain or open-collector output devices (such as I2C lines) and to keep an input from floating (an undefined level) when a switch is in its open state.

Pulse Width Modulation (PWM)

A technique that varies the on-time (duty cycle) of a fixed-period pulse signal to approximate analog control of voltage or power. It is used for motor speed control, LED brightness dimming, and servo motor angle control, and lets an MCU generate an analog-like control quantity directly from a digital output pin without a DAC.

Purchasing models (vCore / DTU)

vCore is a flexible model where you size CPU, memory, and storage separately, with Azure Hybrid Benefit and reserved discounts (recommended). DTU is a simple blended metric of compute and storage.

Purview compliance portal and audit

The Microsoft Purview admin portal centralizing sensitivity labels, DLP, retention, eDiscovery, and audit logs. Audit (standard/premium) tracks user/admin activity.

Purview DSPM for AI

Microsoft Purview Data Security Posture Management for AI. Visualizes sensitive-data risk and overexposure handled by Copilot and AI apps, driving remediation via labeling, access review, and DLP—a proactive posture capability.

Purview Information Protection

Microsoft Purview Information Protection discovers and classifies sensitive information and applies protection (encryption, access restriction, watermarks) via sensitivity labels. It is foundational to limiting exposure in Copilot responses.

Push / pull communication

Push communication is when the sender actively sends information to specific recipients (email, distributed reports), while pull communication is when recipients retrieve information themselves as needed (published materials on an internal portal). Choosing the right mode based on the urgency and audience scope of the information is an important judgment.

push / pull_request events

Core CI events triggered by code pushes or PR open/update; narrow scope via branches/paths (and *-ignore) filters.

pv* commands (physical volume operations)

LVM commands for physical volumes (PV): pvcreate initializes a disk or partition as a PV, while pvdisplay/pvs show PV information.

pyATS and Cisco Modeling Labs (CML)

pyATS (Python Automated Test System) is a Cisco test framework that automates checking device state and running test scenarios in Python. Cisco Modeling Labs (CML) is an environment that simulates a network topology using virtual instances of routers, switches, and the like, letting configuration changes and automation scripts be validated ahead of time without real hardware.

PySpark

The Python API for Apache Spark; transforms large data at scale via DataFrames—one of Fabric’s main transform languages.

Python requests library

A popular third-party Python library (not part of the standard library — it must be pip-installed) for sending HTTP requests. A typical call looks like requests.get(url, headers=, auth=, params=); the response is checked via resp.status_code, and resp.json() converts the response body into a Python dict/list. It also supports POST/PUT and options like verify= for TLS verification, and is the go-to way to call a network device or controller's REST API from a script.

QoS (prioritization & rate control)

Mechanisms to control the quality of multiple traffic types sharing limited bandwidth. Delay/jitter-sensitive voice/video get prioritization (priority queuing); bursty traffic gets shaping (buffering the excess to smooth transmission) or policing (dropping/marking the excess). DiffServ (DSCP) classifies traffic.

Quarantine network

A mechanism that first connects a device such as a brought-in PC to an area isolated from the business network, inspects its antivirus and patch status, and only then permits access to the business network if there is no problem, preventing infection spread from unmanaged endpoints.

Query acceleration (OneLake shortcuts)

In Real-Time Intelligence, caches/indexes data over OneLake shortcuts to speed KQL queries; tested vs standard shortcuts.

Query execution plan

The sequence of steps — order, algorithms (join method, whether to use an index, etc.) — the optimizer chooses to execute a SQL statement. It can be visualized with the DBMS's explain command and is the starting point for diagnosing slow queries, such as an unwanted full table scan.

Query parameters

Values—server names, paths, filter values—changeable in one place; used to switch dev↔prod and templatize.

Query performance optimization

Speeding queries via execution plans, statistics, good joins/filters, and partition pruning; important in the warehouse/SQL endpoint.

Query Store

Retains query text, execution plans, and runtime statistics as history. It underpins regression detection and plan forcing.

Query tools (Azure Data Studio / SSMS)

Tools to connect, run SQL, and manage databases: Windows SQL Server Management Studio (SSMS), Visual Studio Code with the MSSQL extension, and web-based SQL query editors in the Azure portal or Microsoft Fabric (Azure Data Studio was retired on 2026-02-28).

Queue (FIFO)

A data structure in which the first item stored is the first one retrieved (FIFO: First In First Out). Items enter at one end (the rear) and leave from the other end (the front). It is often likened to a line of people waiting at a counter.

Queue (message queue)

A mechanism that temporarily holds messages or tasks awaiting processing; it absorbs speed differences between sender and receiver and underpins asynchronous data processing.

Queue storage

A message queue to decouple components and smooth processing spikes.

Queueing theory (M/M/1)

A theory that models arrivals and service events as random processes to analyze waiting time and queue length probabilistically. In the M/M/1 model, the utilization ρ=λ/μ is derived from the arrival rate λ and service rate μ; as ρ approaches 1, the average wait time and queue length increase sharply. Used to design counter counts and service capacity.

Quiet Time policies

An Intune app-configuration capability for Android/iOS that suppresses mobile app notifications during a specified window (e.g., off-hours or overnight). Aimed at work-life balance or keeping frontline workers focused, it can selectively mute notifications from work apps during that window.

Quoting (single / double / backquote)

Single quotes '…' keep everything literal (no expansion), double quotes "…" expand $variables, and backquotes `…` (= $(…)) perform command substitution, replaced by the output.

RADIUS

A protocol for centralized authentication, authorization, and accounting (AAA). Used as an authentication server in wireless LAN, VPN, and IEEE 802.1X environments, it centrally manages per-user credentials to control network access.

Radix conversion (binary and hexadecimal)

Converting a number expressed in one base into another base. Computers process data in binary, but because binary is long, values are often grouped four bits at a time and written compactly in hexadecimal (binary 1111 = hex F). Decimal-to-binary divides by 2 until the quotient is 0 and reads the remainders in reverse; binary-to-decimal multiplies each digit by its positional weight (…8, 4, 2, 1) and sums them.

RAG (retrieval-augmented generation)

Searching documents and adding them to the prompt for grounded answers; reduces hallucination.

RAG incremental update (delta re-embedding)

On knowledge-base updates, re-chunk and re-embed only the changed documents (not all) and apply to the vector store—cutting ingestion cost/latency while keeping data fresh. Knowledge Bases sync supports incremental ingestion.

RAG optimization

RAG quality depends on retrieval. Tune similarity threshold, chunk size, and retrieval strategy (top-k / re-ranking); for domain specificity, select/fine-tune the embedding model. Complement with hybrid search combining semantic (vector) and keyword retrieval, and evaluate/improve quantitatively with relevance metrics and A/B testing.

RAG retrieval mechanism (semantic/hybrid)

How RAG retrieves relevant documents. Semantic search fetches by embedding similarity (meaning); hybrid search combines keyword (e.g., BM25) and vector to improve recall; a reranker reorders top results, and only the needed evidence is passed to the context.

Rainbow table attack

An attack that uses a precomputed table mapping plaintexts to hash values to quickly reverse a hash back to the original password. Hashing each password with a distinct salt invalidates such precomputed tables.

Ransomware

Malware that encrypts files on an infected PC or server, rendering them unusable, and demands payment in exchange for decryption. In recent years, the dominant tactic is "double extortion" — threatening to leak exfiltrated data in addition to withholding the decryption key. Taking backups and keeping them isolated (offline) is an effective countermeasure.

Rapid Modernization Plan (RaMP)

Guidance that orders Zero Trust adoption by quick, high-impact outcomes (securing privileged access, user access/passwordless, protecting data/apps). Shows leadership "what to harden first." Distinct from the MCRA reference architecture.

RASIS

An acronym for five metrics used to measure the dependability of a system: Reliability, Availability, Serviceability, Integrity, and Security.

RASP (Runtime Application Self-Protection)

A protection technology embedded within the application itself that understands runtime context (call paths, input, data flow) to detect and block attacks in place. Unlike a WAF that inspects external traffic, it can judge malicious behavior from inside the application.

RAT (Remote Access Trojan)

Malware with backdoor functionality that lets an attacker remotely control an infected host at will. After intrusion it is abused as a foothold for lateral movement to other internal hosts, data theft, or ransomware deployment.

Rate anomaly

A phenomenon (rate anomaly) arising because a wireless LAN is a half-duplex medium sharing one channel: a slow device occupies the channel longer to send the same amount of data, dragging down the effective throughput of faster devices that share the same channel.

Rate limiting

Capping the number of requests accepted per unit of time to protect downstream systems from overload and abuse (DoS, scraping, etc.). Commonly implemented as API-gateway throttling or a web-application-firewall rate-based rule.

Rate Monotonic Scheduling (RMS)

A scheduling policy for periodic tasks that statically assigns higher priority to tasks with shorter periods. Among fixed-priority scheduling policies for tasks with known periods and execution times, it is optimal, and the Liu & Layland sufficient condition — total utilization at or below n(2^(1/n)-1) for n tasks — lets designers verify at design time whether deadlines can be met.

RDP Shortpath

An Azure Virtual Desktop feature that establishes a direct UDP path between client and session host instead of the reverse-connect TCP relay, lowering latency and jitter. It has managed-network and public-network variants. Different in purpose from Private Link (private connectivity).

RDS Blue/Green Deployments

A managed feature that creates a copy (Green) of production (Blue), validates engine upgrades or schema changes on Green, then promotes it with a switchover of tens of seconds—applying major updates/patches with reduced risk.

RDS Multi-AZ and read replicas

Multi-AZ provides HA via a synchronous standby with automatic failover (for availability), while read replicas scale reads via async replication (for performance)—distinct purposes.

RDS Performance Insights

A performance-monitoring feature that visualizes DB load by wait events and top SQL to pinpoint bottlenecks, tracking DB load (average active sessions) on a dashboard; complements CloudWatch metrics.

Re-run failed jobs / Re-run all jobs

Re-running only failed jobs vs retrying the whole run; use the former when a specific matrix variant fails and the latter for flaky failures.

Read scale-out

On Business Critical / Hyperscale, routes read workloads to read-only secondary replicas to offload the primary. Used via ApplicationIntent=ReadOnly in the connection string.

Read-write splitting

A database access pattern that always sends writes to the primary instance and routes reads to read replicas to spread load. The split happens at the app layer or via a proxy layer such as RDS Proxy. Because replicas use asynchronous replication, a read immediately after a write can miss the update (replication lag).

README

The entry-point description of a project (overview, usage, contributing); written in Markdown.

Real-Time hub

A central hub to list, discover, and connect to streaming/event data across the org; the entry point to Real-Time Intelligence.

Real-Time Intelligence

The Fabric experience for ingesting, storing, analyzing, and acting on streaming data; includes Eventstream, Eventhouse, KQL, and Data Activator.

Real-Time OS (RTOS)

An operating system designed to control task execution order and response time deterministically (predictably), prioritizing adherence to specified deadlines. Whereas general-purpose OSes optimize for throughput and fairness, an RTOS provides priority-based scheduling and short, bounded interrupt response times to satisfy the timing requirements of control systems and communication equipment.

rebase

Replaying your commits onto the target branch tip to linearize history; careful when shared.

Recommendation systems (collaborative filtering)

Predicts preferences from user-item interactions. Collaborative filtering uses behavior of similar users/items; in SageMaker, Factorization Machines is typical.

Records management and data lifecycle

Microsoft Purview records management declares regulated documents as immutable "records" via retention labels and deletes them after a disposition review past the retention period, integrating with data lifecycle management.

Recursion

A technique in which a function calls itself, used to break a problem down into smaller instances of the same problem (e.g., factorial calculation, tree traversal). Without a terminating condition (base case), the calls continue indefinitely.

Recursion and Divide-and-Conquer

Recursion is a technique where a function calls itself, repeatedly reducing a problem to smaller instances of the same problem until a base case is reached. Divide-and-conquer is an algorithm design strategy that splits a problem into independent subproblems, solves each recursively, and then combines the results; it underlies quicksort, merge sort, and the fast Fourier transform. Recursion is the implementation mechanism, while divide-and-conquer is the higher-level algorithmic design strategy.

Recursive Query and Iterative Query

In a recursive query, the receiving DNS server continues querying other servers on the requester's behalf until it obtains a final answer (or confirms non-existence), returning only that final result. In an iterative query, the receiving server returns the best answer it currently holds — typically a referral to another server — leaving the requester to continue querying itself. Conventionally, stub resolvers issue recursive queries to caching servers, which in turn issue iterative queries to authoritative servers.

Red Hat OpenShift Service on AWS (ROSA)

A managed OpenShift (a Kubernetes distribution) jointly offered by AWS and Red Hat. It brings the OpenShift ecosystem/developer experience onto AWS with the control plane operated for you—chosen when migrating existing OpenShift workloads to AWS.

Redirection (> / >> / 2>&1)

Re-points stream I/O: > overwrites stdout to a file, >> appends, < feeds a file to stdin. Capture both streams with > file 2>&1 (order matters); discard into /dev/null.

Redshift performance (RA3/WLM/dist keys)

RA3 separates compute and storage (managed storage); concurrency scaling temporarily adds clusters for concurrency peaks; workload management (WLM) controls priority/memory via queues; distribution keys (DISTKEY) and sort keys (SORTKEY) optimize joins and scans.

Redshift Serverless

Redshift without cluster management. It auto-scales by usage (RPUs), optimizing cost for intermittent or unpredictable analytics workloads.

Redshift Spectrum

Queries S3 data directly from Redshift. Without loading, it joins across the data lake and warehouse, referencing the Glue Data Catalog.

Reducing context switching

Asking Chat about unfamiliar APIs/errors to reduce switching to a browser or docs, preserving development flow.

Redundancy

Providing multiple components with the same role so the overall service continues even if one fails. A basic building block of HA configurations, realized in combination with clustering and replication.

Redundancy (LRS/ZRS/GRS/GZRS)

Resilience set by number/scope of copies: LRS<ZRS<GRS<GZRS; GRS/GZRS replicate to another region.

Redundancy (majority voting)

A reliability design technique in which multiple identical systems perform the same computation and their outputs are compared, with the majority value adopted, so that a single system's failure does not directly cause a system-wide malfunction. In the common triple modular redundancy (TMR) scheme, if two of the three systems agree, that value is adopted, allowing one system to fail without affecting correctness.

Reentrant

A property of a function or routine whereby it behaves correctly even when called concurrently by multiple tasks or interrupt handlers, or re-entered after being interrupted mid-execution, without corrupting shared state. It is achieved by avoiding modification of global or static variables and relying only on local variables, and it is a required property for functions called from both interrupt handlers and multiple tasks.

Refactoring

The activity of improving the internal structure of a program to raise readability and maintainability without changing its externally observable behavior. Changes such as removing duplicate code, extracting methods, and improving names are made in small, safe steps backed by automated tests that preserve behavior. A system architect treats it as continuous design improvement that curbs the buildup of technical debt and preserves future changeability.

Reference lists and risk values

Reference lists hold known-bad values, watchlists, and risk values referenced by detection rules; rules use them to weight/prioritize threats matching a risk profile.

Reference query (Power Query)

A Power Query feature that creates a new query starting from an existing query's output. The source query's steps are not copied—the reference stays dependent, so changes to the source propagate to it. Used to reuse common upstream preprocessing across multiple downstream queries.

Referential constraint (referential integrity)

A constraint requiring a foreign key's value to actually exist as a primary (or candidate) key value in the referenced table. It prevents orphaned references — child records without a parent — and preserves consistency across tables.

Region (AWS)

A geographically separate area made of multiple Availability Zones (usually 3+); chosen by latency, compliance, cost, and service availability.

Region (Azure)

A geographic grouping of one or more datacenters; chosen by latency, data sovereignty, feature availability, and cost.

Region pair

A pair of distant regions within the same geography—used for broad-disaster redundancy, sequential updates, and as the GRS replication target. Note newer regions (since 2024) may have no pair, in which case availability zones (zone redundancy) are used instead.

Regionalization (resource location constraint)

Enforces data-residency requirements—confining storage/processing to a specific country/region—via the organization-policy resource location constraint; used for data-sovereignty compliance.

Register

The fastest, smallest storage locations, located inside the CPU. They temporarily hold data being operated on, instructions, addresses, and execution state. Types include the program counter (address of the next instruction), the instruction register (the fetched instruction), and the accumulator (arithmetic results).

Registration token

A token that lets a session host (VM) join a host pool; the AVD agent registers with it. It expires, and an expired token blocks the session host from joining.

Registries (cross-workspace sharing)

An org-level catalog to share models, components, environments, and data across multiple workspaces, used to promote from dev to production.

Regression

A supervised task predicting a continuous number (e.g., price, temperature).

Regression analysis

A statistical method that models the relationship between explanatory variables (causes) and a response variable (effect) with an equation, in order to predict or analyze the response variable from the explanatory variables. It includes simple regression (one explanatory variable) and multiple regression (several), typically estimating coefficients via least squares to minimize the sum of squared errors.

Regular expression

A language for describing string patterns: ^ line start, $ line end, . any one char, [abc] a set, * zero-or-more of the previous. Basic (BRE) and extended (ERE: + ? | ( )) forms exist; the * differs from a shell wildcard (any string is .*). Full grammar in regex(7).

Regular expressions and automata

Regular expressions are a notation for describing string patterns using symbols, and their processing can be implemented as a finite automaton (state transitions). This forms the theoretical basis of string search and pattern matching.

Regulatory compliance (standards / custom)

Defender for Cloud’s regulatory compliance dashboard assesses conformance to standards like PCI DSS or ISO, and lets you add custom standards for your own requirements.

REINDEX

A SQL command that rebuilds a bloated or corrupted index. Plain REINDEX takes an exclusive lock on the target table (or the relevant index) before rebuilding, so reads and writes to that table are blocked while it runs. Since PostgreSQL 12, the REINDEX CONCURRENTLY option avoids that exclusive lock, allowing the index to be rebuilt online while reads and writes continue (though it briefly blocks other DDL and cannot run inside a transaction block). Whether an exclusive lock is required is DBMS-dependent behavior.

REINDEX CONCURRENTLY

An index-rebuild command available from PostgreSQL 12 onward. Unlike plain REINDEX, it does not take an exclusive table lock, so it rebuilds the index without blocking writes. However, a failure partway through can leave an INVALID index behind, which must then be dropped and rebuilt manually.

Reinforcement learning

ML that learns good actions (a policy) by trial and error via rewards and penalties; e.g., robotics, games.

RELATED (DAX)

A DAX function that follows a many-to-one relationship from the “many” side to fetch a column value from the related “one” side table; used in calculated columns/measures to reference an attribute from another table. Traversing the opposite direction (one-to-many) requires RELATEDTABLE instead.

Relational algebra

A mathematical query language defining operations on relations (tables): selection, projection, join, union, difference, Cartesian product, and division. SQL queries are internally translated into relational-algebra operations, which the optimizer rewrites into equivalent forms to build an execution plan.

Relational data model

A data model that represents data as a set of two-dimensional tables (relations) made of rows (tuples) and columns (attributes). Tables are related via keys and manipulated through set-based queries (SQL).

Relational database

A database storing data in tables related by keys, operated with SQL.

Relational model

A data model that represents data as a set of tables (relations) made of rows (tuples) and columns (attributes). Proposed by E. F. Codd, it rests on the mathematical basis of relational algebra and relational calculus, giving queries a precise semantics.

Relational objects (views/stored procedures)

Beyond tables, database objects like views (saved queries), stored procedures, and functions structure data access.

Relationship

In data modeling, a concept representing the association between entities, expressed through cardinality such as one-to-one, one-to-many, or many-to-many. Shown as diamonds or lines in E-R diagrams, many-to-many relationships are decomposed into associative entities (junction tables) during implementation.

Relationship (Dataverse)

Associations between tables—one-to-many (one parent, many children) and many-to-many (both sides many)—used to reference and filter related data.

Relative and absolute references (spreadsheet)

Ways of specifying the cell a spreadsheet formula refers to. With a relative reference, the referenced cell shifts according to position when the formula is copied — handy when each row should compute a different cell. An absolute reference fixes the target using "$", for keeping every row pointed at the same cell, such as a tax rate. A mixed reference fixes only the row or only the column with "$" (e.g., $A1, A$1).

Release and deployment management

The activity of delivering approved changes into the production environment by building and testing them as a release unit and deploying them according to plan. Deployment approaches include big-bang, phased, and pilot (early) rollout, chosen according to risk and blast radius. Separating build-and-test from production deployment, and confirming the quality of the release package before rollout, limits the impact of failures. The IT service manager designs the release unit and deployment approach, factoring in backout and service downtime to control the transition.

Releases

Publishes a specific version tied to a tag, with release notes and assets.

Reliability

The ability to recover from and withstand failures/disasters; if HA means "do not fall," reliability means "get back up."

Remote (origin)

A named reference to where a repository is stored; the clone source defaults to origin.

Remote actions (retire / wipe / device query)

Retire removes only org data/management and keeps personal data (e.g., BYOD offboarding); wipe fully resets the device (lost/redeploy); device query queries device state on the fly with KQL; rotate BitLocker recovery keys refreshes keys.

Remote GUI (DISPLAY / xauth / X11 forwarding)

Displaying a remote GUI app on your local screen: the DISPLAY variable points to the target X server and xauth manages authorization. In practice, ssh -X (X11 forwarding) shows it over the SSH tunnel.

Remote Help (Intune Suite)

An Intune Suite add-on letting help desk staff remotely connect to an end user's device for view-only or full-control remote assistance. Entra ID-based authentication and RBAC govern help desk permissions, and connections work without a VPN even from outside the corporate network.

RemoteApp

An Azure Virtual Desktop application-group type that publishes individual apps as seamless windows rather than a full desktop. Distinct from a desktop app group, which publishes the full desktop.

Replication

A mechanism that copies data (e.g., of a database) from a master to one or more replicas; used to distribute read load and to serve as a failover target if the master fails.

Report (Power BI)

Multi-page interactive analysis on one dataset—arrange visuals and explore with filters and drill-down; authored in Power BI Desktop.

Reporting and data visibility (Intune)

A set of features in the Intune admin center that visualize compliance and deployment status through org/device/policy-level reports, workbooks, and dashboards, and let admins export data (e.g., to CSV) for further analysis. Covers both operational reports and organization-wide dashboards.

Repository

The container holding a project files and its full history/metadata; physically the hidden .git folder.

Repository roles

Per-repo access levels—Read / Triage / Write / Maintain / Admin—plus custom repository roles for fine-grained control. Assign by team, not per individual.

repository_dispatch

A trigger started by external systems via API (POST) with a custom event name; used for external integration.

Request fulfilment (service request)

The process that handles routine user requests for which procedures, approvals, and costs are predefined (issuing accounts, installing standard software, providing information), rather than unplanned interruptions. It is kept distinct from incident management, which handles failures, and from non-routine changes that require change management.

Request Units (RU/s)

The throughput and billing unit of Cosmos DB; reads/writes/queries each consume RU. Configured as provisioned (manual RU/s or autoscale) or serverless (consumption). Insufficient RU returns 429 (rate limiting).

Requester Pays

A bucket setting that charges request and data-transfer costs to the requester instead of the owner—used to share cost when distributing large datasets to many external consumers.

Requirements definition

An upstream software development process step that clarifies the functions and performance the users or client require and fixes the scope of what will be built. Misunderstandings here directly translate into costly rework in later stages.

Reranker

A later-stage component that reorders retrieved candidates by relevance to improve top results. Applied after hybrid search, it does not replace retrieval (embeddings/vector search).

Researcher (built-in agent)

One of Microsoft 365 Copilot’s built-in agents. It performs deep research across internal data and the web, working through complex investigation tasks step by step.

Reserved Instance types

Standard RIs give the deepest discount with limited changes; Convertible RIs allow changing family/OS, etc. (lower discount). Regional RIs are flexible across AZs, while Zonal RIs add a capacity reservation in a specific AZ. Payment: all/partial/no upfront.

Residual risk

The risk that remains after risk treatment (reduction, avoidance, transfer) has been applied. Because risk can never be reduced to zero, management must judge whether the remaining level is acceptable and formally approve accepting it.

Resilience

The property of a system to keep functioning, or to recover quickly, even when a failure occurs; strengthened through redundancy, clustering, and geographic distribution.

Resolving nulls and missing data

Handling nulls, missing, and duplicate values via exclusion, default substitution, or aggregation; directly affects result correctness.

Resource Access Manager (RAM)

Shares specific AWS resources (Transit Gateway, subnets, licenses, etc.) across accounts and the organization, letting multiple accounts use them without duplication.

Resource account

An account required to assign a phone number to an auto attendant or call queue. Distinct from a regular user number.

Resource Governor

Classifies workloads into resource pools/workload groups and caps their CPU, memory, and I/O (for VM/MI).

Resource group

A container grouping related resources for shared permissions/lifecycle; a resource belongs to exactly one RG.

Resource hierarchy

The Google Cloud hierarchy of Organization → Folder → Project → resources; the project is the basic billing/permission unit and policies inherit down the hierarchy.

Resource leveling

A technique that adjusts activity start and finish dates to keep a specific resource allocation from exceeding its limit, thereby revising the schedule. Because the resource constraint takes priority, the critical path can change and the project end date usually extends, which distinguishes it from resource smoothing, which only adjusts within available float.

Resource lock

A safety net preventing deletion or change (CanNotDelete / ReadOnly), stopping mistakes even by authorized users.

Resource record (RR)

The individual configuration entries written in a DNS zone file. Types include SOA (zone authority info), NS (name server), A/AAAA (IPv4/IPv6 address), MX (mail server), CNAME (alias), and PTR (reverse lookup).

Resource-based policy

A policy attached to a resource itself—such as an S3 bucket policy or SQS queue policy—that defines who can access that resource. Because it includes a Principal element, it can grant access to a principal in another account that doesn't own the resource, making it the standard way to enable cross-account access.

Response plan

A plan defining who handles which vulnerability/alert, at what priority, by when—including SLA, roles, and records—to prevent neglect and ensure remediation.

Response to IT (internal control component)

The sixth internal control component added by Japan's J-SOX implementation standards on top of COSO's five. It refers to an organization appropriately addressing the IT environment (IT infrastructure, application controls, and IT general controls) used in its operations to achieve internal control objectives. Auditors evaluate both IT general controls (access management, change management, etc.) and application controls.

Responsibility assignment matrix (RAM/RACI)

A chart mapping work items to team members and classifying each role as Responsible (R), Accountable (A), Consulted (C), or Informed (I). The rule that exactly one person holds Accountable for each task is essential, since it prevents overlapping or missing responsibility, which matters for project control.

Responsibility boundary (cloud shared responsibility model)

The division of security responsibility between a cloud provider (security "of" the cloud — protecting physical facilities and underlying infrastructure) and a customer (security "in" the cloud — protecting access settings, data, and applications) when using a cloud service. The customer's scope of responsibility changes with the service model (IaaS/PaaS/SaaS), and misunderstanding this boundary — such as leaving a storage bucket publicly exposed — has been the actual cause of real-world incidents.

Responsible AI

Guidance for using AI safely, fairly, transparently; Microsoft’s six: fairness, reliability & safety, privacy & security, inclusiveness, transparency, accountability.

Responsible AI dashboard

A set of Azure ML tools to assess models for responsible AI, offering error analysis, interpretability, fairness, and counterfactuals in one dashboard.

Responsible AI dimensions

Designs and operates AI across fairness, explainability, transparency, robustness, privacy, safety, and governance, mitigating bias and harmful outputs.

Responsive design

Designing layouts that auto-adjust to screen size (PC/tablet/phone); in canvas apps, achieved with containers and formulas.

REST API (network automation)

An API design style that operates on resources using HTTP methods (GET/POST/PUT/DELETE, etc.). It lets scripts query and change configuration on a controller such as Catalyst Center by exchanging JSON-formatted data, enabling bulk operations across many devices instead of logging into each device's CLI individually.

restart_after_crash

A parameter controlling whether the entire server automatically restarts after a backend crash (default on). Setting it to off leaves the server stopped after an abnormal termination, useful when automatic recovery is undesirable until the cause has been investigated.

Restricted entities

Shows users restricted from sending (e.g., due to bulk spam); remediate the cause and remove the restriction. Distinct from Conditional Access (sign-in control).

restricted Google access

Limits reachable Google APIs to only allowed services (via restricted.googleapis.com), aligning with VPC Service Controls to block exfiltration paths; used with Private Google Access.

Retention

How long logs, artifacts, and runs are kept; set at repo/org level and tunable via retention-days at upload. Manageable via the REST API and affects storage billing.

Retention policy

Keeps data for the required period and deletes it when no longer needed, managing its lifecycle.

Retrieval-layer diagnosis

When RAG answer quality is poor, diagnosing the cause at the retrieval layer—checking embedding fit, data drift, chunking strategy, search recall/precision, and metadata filters in turn, and fixing it distinctly from the generation side (prompt/model).

Retrohunt

Applying new detection logic or newly known IOCs retroactively to previously ingested event data to find missed compromise; done with the Google SecOps rules engine or BigQuery/Cloud Logging.

Retry design

A design that retries after a transient failure using exponential backoff with jitter. A naive immediate retry can cause a retry storm—many clients retrying in sync and worsening the outage—so random jitter spreads retries out over time. It is safe to use only for idempotent operations.

Retry policy

A setting that auto-reruns an activity on transient failures (e.g., brief network drops); combine with failure paths for robustness.

Reusable assets (.pbit / .pbids)

.pbit is a Power BI template (model/layout blueprint); .pbids is a data-source connection definition; shared to reuse the same setup.

Reverse connect transport

The default Azure Virtual Desktop connection method that connects to clients using only outbound 443, with no inbound ports on session hosts—reducing attack surface by not exposing inbound RDP (3389).

Reverse engineering

A technique of analyzing an existing program or artifact and recovering design information or specifications from its structure. It is used to understand or as a starting point to rebuild an existing system whose design documents have been lost. In contrast, forward engineering proceeds from specification to implementation, and reengineering is the overall reconstruction of improving the recovered specification and rebuilding it forward. The architect combines these in legacy renewal to leverage existing assets.

Reverse proxy

A proxy positioned on the server side that receives client requests and relays them to one or more backend servers; used for load balancing, SSL termination, and caching. Its direction is the opposite of a forward proxy (used on the client side).

Reverse replication

A mechanism that writes back from the new environment to the old after a migration cutover, providing rollback insurance to safely fall back if problems arise.

Review

An activity in which stakeholders read through deliverables (design documents, programs, etc.) to find errors and problems early. Because defects can be caught in upstream phases before running tests, it reduces costly rework later.

Review techniques (walkthrough and inspection)

Static verification techniques for finding defects without executing code or a design document. A walkthrough is author-led and relatively lightweight, with the author explaining the work to participants; an inspection is the most formal method, run by a moderator with defined roles and checklists under a strict procedure. Both remove defects cheaply early in the development process.

RFI and RFP

Request documents sent by a buyer to vendors during system procurement. An RFI (Request for Information) asks about technical information and track record, while an RFP (Request for Proposal) presents requirements and asks for a concrete proposal and estimate; the RFI is typically issued first.

RIP

A distance-vector IGP that uses hop count as its metric. It treats hop count 16 as unreachable (infinity), so the maximum usable hop count is 15. Simple to configure but slow to converge and unsuited to large networks; its default administrative distance is 120.

RISE with SAP

An SAP offering where SAP operates the S/4HANA environment managed (SaaS-like); the customer owns integration and surrounding services. Connect the separate-subscription SAP environment to the customer VNet privately (VNet peering/private endpoints).

Risk

The likelihood that a threat will exploit a vulnerability and actually cause harm. It is generally framed as probability times impact; a vulnerability alone does not create risk, only its combination with a threat capable of exploiting it.

Risk analysis

A step within risk management that evaluates the likelihood and impact of identified risks to prioritize responses. It can be qualitative (ranking impact by severity level) or quantitative (expressing impact in monetary terms).

Risk assessment

The process of identifying, analyzing, and evaluating risk by surveying the threats and vulnerabilities affecting information assets. It quantifies risk magnitude (likelihood times impact) as the basis for subsequent risk treatment decisions, forming the core of the Plan phase in the ISMS PDCA cycle.

Risk criteria

Predefined standards an organization uses to evaluate the magnitude of risk and decide whether treatment is needed and at what priority. They include the level of acceptable risk (risk acceptance criteria); during risk evaluation, analysis results are compared against these criteria to determine whether a response is required. The criteria are set based on organizational policy, laws, and the business environment.

Risk management

The overall management process by which an organization identifies, analyzes, and evaluates the risks it faces, selects and implements responses, and continuously reviews them. Risk analysis is the step within this process that assesses the likelihood and impact of each risk, making it a subset of risk management.

Risk treatment (reduction, avoidance, transfer, acceptance)

Four response strategies chosen based on risk assessment results. Reduction lowers likelihood or impact through controls; avoidance stops the activity causing the risk; transfer shifts the risk to a third party via insurance or outsourcing; acceptance tolerates the risk without further action when it falls within an acceptable range. The choice balances cost against effect.

Risk-based audit approach

An approach to planning and executing an audit that, given finite audit resources, concentrates effort on the areas of highest risk and materiality rather than examining every process or system to a uniform depth. Based on the assessed inherent and control risk, the auditor selects focus areas and applies more extensive procedures to higher-risk areas to make the audit more effective. This corresponds to the audit-risk framework (audit risk = inherent risk x control risk x detection risk): based on the assessed inherent and control risk, the auditor sets the nature, timing, and extent of procedures so as to hold detection risk to an acceptable level.

Risk-based authentication

An authentication method that dynamically assesses risk from the login context (source IP, device, time of day, behavior patterns) and demands additional authentication (such as an extra one-time password) only when signs deviate from the norm, balancing usability and security.

RLHF (reinforcement learning from human feedback)

A reinforcement-learning method that tunes an LLM toward desirable responses using human ratings as reward.

Robust FM API integration

Integrating FM APIs at production quality: streaming/async for perceived latency and throughput, exponential backoff + retry for throttling, X-Ray for distributed tracing, error logs and validation for diagnosis, and loose coupling (event-driven) to localize failures.

ROI (Return on Investment)

A profitability measure calculated by dividing the profit generated by an investment by the investment amount (ROI = profit divided by investment). A higher value indicates greater investment efficiency, but because it does not reflect the time required for payback or the time value of money in the cash flows, it is best combined with other measures such as NPV, IRR, and the payback period when making an investment decision.

Role groups

A delegation unit for permissions within an individual workload's admin center, such as Microsoft Defender or Microsoft Purview. Adding a user to a role group grants the permissions of the roles assigned to that group (e.g., Security Reader, Compliance Administrator). It provides workload-scoped least privilege distinct from tenant-wide Entra ID roles.

Role of the OS (operating system)

Basic software positioned between hardware and application software, responsible for memory management, task management, file management, and input/output control. Applications access hardware through the functions the OS provides.

Role-based access control (RBAC)

Authorization that grants permissions by assigning roles to identities at a scope; least privilege, inherited downward.

Role-playing dimension

Using one dimension (e.g., date) in multiple roles (order/ship date), switching inactive relationships at calculation time via USERELATIONSHIP.

Roll-forward recovery

A recovery method that applies the log records (redo log) generated after a backup, in order, to restore the database to its state just before a failure. It recovers committed updates made since the backup without losing them.

Rollback and checkpoint (recovery)

Rollback is a recovery operation that, on transaction failure, restores data to the state before the transaction began, preserving consistency. A checkpoint periodically flushes in-memory updates to disk and records a consistent reference point in the log, so on failure recovery can roll forward using only the log after the last checkpoint, shortening recovery time. The architect designs the checkpoint interval and log operation to balance performance against the recovery time objective.

Rollup column (Dataverse)

A Dataverse column that automatically aggregates related child rows (sum, count, min/max, etc.). It recalculates on an asynchronous, periodic job rather than instantly, unlike a calculated column (same-row formula, evaluated immediately)—a common exam distinction.

ROM

A read-only (Read Only Memory) storage device — non-volatile memory whose contents are not lost when the power is turned off. It is used to store data that does not need to be rewritten, such as a computer's startup program. It contrasts with main memory (RAM), whose contents are lost when the power is turned off.

Root Bridge and Root Bridge Election

The root bridge is the reference point at the top of the tree topology that STP builds; every other switch computes its shortest path toward it. Election is automatic: the switch with the lowest bridge ID (bridge priority plus MAC address) in exchanged BPDUs becomes root, with MAC address as a tiebreaker when priorities are equal. Administrators can force a specific switch to become root by manually lowering its priority value.

Root guard

An STP feature that, on a switch port facing a device that should never become the root bridge, blocks the port in a root-inconsistent state if it receives a superior BPDU (one with a lower bridge ID). It heads off a topology change where a misconnected or rogue device usurps the root bridge role, and differs from BPDU guard, which err-disables the port outright on receiving any BPDU.

Root user

The all-powerful account-creation user; protect with MFA, avoid daily use, and use IAM users/roles instead.

Root user protection

The root user (created with the account) has near-unlimited power, so it must be protected and not used daily: enable MFA, avoid/delete access keys, use a strong password, and reserve it for the few actions that require it (billing/closure). Monitor via Organizations.

Rootkit

A set of tools that conceal their own presence and that of other malicious programs after intrusion, sustaining privileged activity. Burrowing into deep parts of the OS (e.g., the kernel), they disguise processes, files, and communications to hinder detection.

Route 53 DNSSEC

Signs DNS responses so tampering and cache poisoning are detected via validation. In Route 53 it is enabled via zone signing with a KMS key.

Route 53 health checks and failover

Monitors endpoint health and, on failure, fails over to a healthy target via failover routing. It also supports calculated health checks and CloudWatch alarm integration.

Route 53 hosted zones (public/private)

Containers holding a domain’s records. Public hosted zones serve the internet; private hosted zones serve within VPCs. You can build split-view DNS with both for the same name.

Route 53 Resolver

The mechanism handling hybrid DNS resolution for a VPC. An inbound endpoint accepts queries from on-premises into VPC resources (Amazon-provided DNS), while an outbound endpoint forwards queries from the VPC to on-premises DNS servers according to conditional forwarding rules. Used when on-prem and cloud need to share a single namespace.

Route 53 Resolver DNS Firewall

A service that evaluates DNS queries issued from a VPC against domain lists and blocks resolution of malicious or unapproved domains. It is used to detect and stop malware C2 communication and data exfiltration via DNS tunneling; query logs can be exported as DNS logs to CloudWatch Logs or S3.

Route 53 Resolver endpoints

Hybrid DNS. An inbound endpoint lets on-premises resolve names inside AWS; an outbound endpoint plus Resolver rules forward specific domains from AWS to on-premises DNS—enabling mutual name resolution between VPCs and on-prem.

Route 53 routing policies

Policies that control how DNS responds: failover routing (to standby via health checks), latency routing (to the nearest region), weighted routing (proportional split), geolocation routing, and more—improving availability and performance.

Route priority

A value that decides which route is chosen when multiple share a destination; a lower value wins. Combine with network tags to scope where it applies.

Route Redundancy

Route redundancy is a design approach that provisions multiple paths to a destination so that a single link or device failure does not cause total loss of reachability. It is typically combined with dynamic routing's automatic failover to alternate paths and equal-cost multi-path load balancing to improve availability.

Route table

A set of rules deciding where a subnet’s traffic goes: each destination CIDR maps to a target (IGW, NAT GW, peering, endpoint, etc.). Longest-prefix match wins; the local (in-VPC) route cannot be removed.

Router and hub (network devices)

A hub is a concentrator that connects devices on a LAN. A repeater hub floods data to all ports regardless of destination, while a switching hub sends only to the destination port. A router bridges different networks (e.g., a home LAN and the internet), forwarding to the destination IP along the best path based on a routing table, and also provides NAT to translate between internal private and external global addresses.

Router ID (OSPF)

A 32-bit value the OSPF process uses to uniquely identify a router within the network. If not manually configured, it is auto-selected as the highest IP address among loopback interfaces, or failing that, the highest address among physical interfaces. A duplicate router ID is a classic cause of adjacency-formation failures.

Routing

The process of determining the path packets take from source to destination across a network. Routers use a routing table that can be set statically or updated dynamically through routing protocols such as RIP or OSPF.

Routing (system routes, service chaining, forced tunneling)

Azure path control. System routes are auto-provided by Azure for intra-VNet, peering, gateways, and default internet. UDRs (user-defined routes) override them, defining destination prefix → next hop (virtual appliance/gateway/internet/none). Service chaining sets the UDR next hop to an NVA (firewall) to force traffic through it (IP forwarding required on the NVA; for redundancy front it with an internal Load Balancer). Forced tunneling forces outbound internet via on-prem with a UDR. Gateway transit lets spokes share the hub’s VPN/ExpressRoute gateway. Route selection: longest-prefix match, then UDR > BGP > system.

Routing protocol types (distance-vector, link-state, path-vector)

This classifies routing protocols by their operating principle. Distance-vector protocols exchange only distance-and-direction information with neighbors and update routes incrementally (e.g., RIP). Link-state protocols have each router hold a full topology map and compute shortest-path trees (e.g., OSPF). Path-vector protocols exchange the sequence of traversed AS numbers as a route attribute, used for loop prevention and policy control (e.g., BGP).

Routing Table

A routing table is the data structure a router maintains, mapping destination networks to next hops, outgoing interfaces, and metrics needed to reach them. It merges static routes, routes learned via dynamic protocols, and directly connected routes; the longest-match entry is selected when forwarding packets.

Row (record)

One item of data in a table, holding values across its columns; formerly called a record.

Row-level security (Fabric)

Data-level security that limits which rows a user sees; in the warehouse/SQL endpoint/semantic model, predicates restrict rows.

Row-level security (RLS)

Restricts which rows each user can see using a security predicate (function). Used for tenant isolation and scoping access by responsibility.

RPA (robotic process automation)

Technology where a software robot mimics human UI actions (click, type, copy) to automate work; in Power Automate this is desktop flows—useful when there is no API.

RPC and synchronous / asynchronous calls

RPC (remote procedure call) is a design style that invokes a remote procedure as if it were a local function call, in contrast to resource-oriented REST. A synchronous call blocks the caller until a response returns. An asynchronous call continues without waiting for the response, retrieving the result later via a callback or polling — well suited to long-running work.

RPF check

A mechanism that prevents multicast loops. For each multicast packet it receives, a router checks whether the interface it would use to route back (unicast) toward the packet's source address matches the interface the packet actually arrived on — the reverse-path-forwarding check — and drops the packet if the two do not match.

rpm (direct RPM handling)

The query-rich low-level tool beneath yum: -qa list all, -qi info, -qR requires, -ql package->files, -qf file->package, -V verify tampering, --checksig signature. Add -p to inspect an uninstalled rpm file. It resolves no dependencies.

RPO (Recovery Point Objective)

A target indicating how far back in time data must be recoverable after a failure, determined by backup frequency; a smaller RPO means less tolerable data loss. Distinct from RTO, which is about recovery time.

RPO (Recovery Point Objective)

The target point in time to which data must be recoverable after a failure occurs. A shorter RPO means less tolerable data loss and requires more frequent backups or replication. It is defined alongside RTO (time to recovery) to set BCP objectives.

RSPAN and ERSPAN

Extensions of SPAN used when the mirrored port and the monitoring tool are not on the same switch. RSPAN forwards mirrored traffic to another switch over a dedicated VLAN, staying within one Layer 2 domain. ERSPAN encapsulates the mirrored traffic in GRE so it can cross Layer 3 boundaries, reaching a monitoring tool at a remote site.

RSTP and Rapid PVST+

RSTP (IEEE 802.1w) collapses the original STP (802.1D) four states (blocking/listening/learning/forwarding) into discarding/learning/forwarding and, via alternate ports (backup paths) and a proposal/agreement handshake, converges far faster than STP. Rapid PVST+ is Cisco's implementation that runs an independent instance of RSTP per VLAN, allowing a different root bridge and load balancing per VLAN.

rsyslog (system logging)

The standard syslog logging daemon; rules in rsyslog.conf use "facility.priority action", where a priority matches that severity and above. Forward to a central log server with @host (UDP) or @@host (TCP). Write log entries manually with logger.

RTO (Recovery Time Objective)

A target for how much time is allowed to restore service after a failure occurs; a smaller RTO means faster recovery is required. Distinct from RPO, which concerns tolerable data loss.

RTO (Recovery Time Objective)

The target amount of time within which business operations or systems must be restored after a failure or disaster occurs. It is a distinct axis from RPO (how far back in time the data must be recovered) and serves as the basis for choosing backup methods and recovery procedures in a BCP or DR plan.

Rule-based, behavioral, and statistical detection

Three families of detection. Rule-based detection matches known attack patterns (signatures) — strong against known threats but prone to missing novel ones. Behavioral detection flags activity that deviates from normal behavior, catching unknown threats at the cost of more false positives. Statistical detection flags numerical deviation from an established baseline, such as a sudden traffic spike.

Ruleset

Guardrails that enforce branch protection, required reviews, and required status checks across orgs. A layer distinct from policies (member capabilities), governing code changes.

Run Command

A Systems Manager feature to run commands/scripts across many instances at once without SSH/RDP, targeting by tags and aggregating results.

Run history

The list of a workflow’s past runs; used to find when/from which change it began failing and to isolate causes.

Runner

The environment that runs Actions jobs; GitHub-hosted or self-hosted.

Runner group

A unit grouping self-hosted runners to control which orgs/repos may use them; can restrict a sensitive runner to specific repos.

runs-on

The key selecting the runner for a job; specify a GitHub-hosted label like ubuntu-latest or a self-hosted label.

S/MIME

A standard that protects email bodies and attachments with public-key encryption and digital signatures. Encryption provides confidentiality, while signatures provide sender authenticity and tamper detection (integrity); its use requires PKI certificates.

S3 access control (bucket policy/ACL/ownership)

A bucket policy is a bucket-level resource policy (the recommended control); ACLs are legacy object/bucket permissions (now recommended to disable). Object Ownership’s “bucket owner enforced” disables ACLs to consolidate on policies; Block Public Access is the backstop.

S3 Access Points

Creates multiple named entry points to a single bucket—one per app/team—each with its own access policy, splitting up large, complex bucket policies for easier management.

S3 Batch Operations

A managed job that performs operations (copy, tagging, ACL changes, Lambda invoke, restore) across billions of objects at once; targets are specified via an S3 Inventory or manifest.

S3 Bucket Key

A feature that, when encrypting with SSE-KMS, reuses a short-lived bucket-level data key instead of calling KMS per object, sharply cutting the number of KMS API calls. It reduces KMS API cost and request-based throttling, and is recommended whenever a workload stores large volumes of objects under SSE-KMS.

S3 default encryption

A setting that automatically encrypts newly stored objects in a bucket. Today it is on by default for every S3 bucket (SSE-S3) and cannot be turned off; switching to SSE-KMS or DSSE-KMS lets you meet stronger key-management or compliance requirements.

S3 developer features (presigned URLs, encryption)

Presigned URLs grant temporary upload/download permission, multipart upload parallelizes large objects, and encryption is chosen among SSE-S3, SSE-KMS, SSE-C, and client-side.

S3 encryption and public-access prevention

S3 data protection. Choose encryption from SSE-S3 (AWS-managed key), SSE-KMS (CMK control, CloudTrail audit), or DSSE-KMS (double encryption). Prevent accidental exposure with Block Public Access (account & bucket) + restrictive bucket policy + ACL disablement.

S3 Event Notifications

Sends object create/delete events to SNS, SQS, Lambda, or EventBridge to trigger processing automatically—used for upload-driven thumbnailing or ingestion pipelines.

S3 lifecycle (transition and expiration)

Rules that auto-manage objects by age. Transition moves to cheaper storage classes (e.g., Standard-IA at 30 days, Glacier at 90); expiration auto-deletes old objects, noncurrent versions, and incomplete multipart uploads to control cost.

S3 Object Lambda

A feature that inserts a Lambda function between an S3 GET request and the underlying bucket to transform the response data on the fly. It enables use cases like PII masking, image resizing, or CSV-to-JSON conversion without changing application code or duplicating the data.

S3 Object Lock

Protects objects as WORM (write-once-read-many), blocking delete/overwrite during retention. Modes: governance (privileged override), compliance (no one can remove), plus legal hold (indefinite). Used for regulatory compliance and tamper-proofing.

S3 performance features (Transfer Acceleration / S3 Select)

Transfer Acceleration speeds long-distance uploads via edge, and multipart upload parallelizes large objects. S3 Select (SQL to retrieve part of an object) is deprecated for new use; query S3 with Athena, etc. instead.

S3 replication features (RTC/batch/inventory)

Replication Time Control (RTC) guarantees replication within 15 minutes with an SLA; batch replication copies pre-existing objects after the fact; S3 Inventory periodically lists objects with encryption/replication status as input for audits and batch operations.

S3 replication rules (CRR/SRR/bidirectional)

CRR = cross-Region (DR, geo-proximity); SRR = same-Region (log aggregation, account separation). Bidirectional replication supports multi-Region read/write. Scope by prefix/tag, and configure owner override and batch replication of existing objects.

S3 server access logging

Records detailed requests to a bucket (requester, operation, response) and stores them in another bucket—used for access analysis and security audits; CloudTrail data events complement it at the API level.

S3 storage classes

Tiers chosen by access frequency and cost: Standard (frequent), Standard-IA/One Zone-IA (infrequent, retrieval fees), Intelligent-Tiering (auto-optimizing), and Glacier Instant/Flexible/Deep Archive (archival). Lifecycle rules transition automatically; One Zone is cheaper in a single AZ but less durable.

S3 Storage Lens

Analyzes S3 usage and activity across an organization, surfacing recommendations for cost optimization and data protection, with cross-account visibility into storage trends.

S3 versioning and replication

Versioning enables recovery from overwrites/deletes, cross-/same-Region replication auto-copies to another location, and MFA Delete protects deletions.

SaaS (Software as a Service)

Using finished software as-is; the provider manages almost everything (e.g., Microsoft 365).

Safe Attachments

In Defender for Office 365, detonates attachments in a sandbox to detect unknown malware. Distinct from Safe Links (which protects URLs).

Safe Links

In Defender for Office 365, re-evaluates URLs at click time to block malicious links (effective for delayed weaponization). Distinct from Safe Attachments (which protects attachments).

Saga pattern (compensating transactions)

A pattern for keeping updates that span multiple microservices consistent when each service has its own database. Rather than one ACID transaction, it chains each service's local transaction and, if a step fails partway, runs compensating transactions in reverse to undo the completed steps, achieving eventual consistency. It has two implementation styles: orchestration, where a central orchestrator directs each step, and choreography, where each service proceeds autonomously via a chain of events. It is chosen when the design wants to avoid two-phase commit for distributed transactions.

SageMaker Autopilot

An AutoML feature that automates preprocessing, algorithm selection, and tuning from tabular data, producing explainable candidate models.

SageMaker Clarify (bias/explainability)

Detects bias in training data and models and explains each feature’s contribution to predictions via SHAP values, used to assess fairness and transparency.

SageMaker Data Wrangler

A largely GUI tool to import, analyze, preprocess, and transform features. It applies 300+ built-in transforms and exports the flow as a pipeline.

SageMaker Debugger

Captures tensors and metrics during training and uses rules to detect issues like vanishing gradients, overfitting, and idle resources to optimize training.

SageMaker Experiments

Records, organizes, and compares training trials (parameters, metrics, artifacts) for reproducible experiment management.

SageMaker Feature Store

A repository to store, share, and reuse features; provides an online store for low-latency inference and an offline store (S3) for training, sharing one definition across both to prevent training-serving skew.

SageMaker inference options

Choose among four by requirement. Real-time = always-on, low latency (Auto Scaling; many models via multi-model endpoints). Serverless = scales to zero when idle (intermittent; cold starts). Asynchronous = queue large payloads/long-running. Batch transform = offline scoring of a whole dataset with no endpoint.

SageMaker JumpStart

A hub to deploy and fine-tune pretrained models (including foundation models) and solution templates with one click.

SageMaker Model Registry

A catalog that versions models in model package groups and gates deployment via approval status (approved/rejected).

SageMaker Neo

Compiles and optimizes trained models for specific edge/cloud hardware to make inference faster and lighter.

SageMaker Pipelines

CI/CD orchestration that automates the ML lifecycle (process→train→evaluate→register→deploy) as a reproducible DAG, with condition steps for quality gates.

SageMaker Processing jobs

Jobs that run preprocessing, postprocessing, and model evaluation at scale on managed compute, executing arbitrary containerized processing in a distributed way.

SageMaker training input modes and data delivery

Choose data delivery for large-scale training. File mode copies all data to EBS before training (small/simple but slow start); Pipe mode streams directly from S3 (large data, fast start); Fast File mode lazy-loads POSIX-like (ease + speed). For reusing the same data across many jobs/HPO, use FSx for Lustre (S3-integrated parallel FS). Built-ins handle RecordIO-protobuf efficiently (good for sparse data).

SageMaker training jobs and distributed training

Managed jobs that train models with built-in algorithms or custom containers, using data/model-parallel distributed training and managed spot for large-scale, low-cost training.

Salesforce connector

A connector to Salesforce CRM data; a typical example of integrating an external SaaS. A premium connector.

Salt and stretching

Hardening techniques for storing passwords as hashes. A salt appends a per-user random value to defeat rainbow-table attacks, and stretching (key stretching) repeats the hash computation many times to raise the cost of brute-force attacks.

Same Origin Policy

A fundamental browser security mechanism that, in principle, restricts documents or scripts loaded from one origin (scheme, host, port) from accessing resources of a different origin. CORS is the mechanism that relaxes this within a permitted scope.

SAML SSO (single sign-on)

Members authenticate at the IdP (Entra ID, Okta, etc.) before accessing GitHub. It handles authentication and lets you cut departed users centrally; auto-removal of accounts is SCIM’s job, not SAML alone.

Sampling (statistical vs. non-statistical; test check vs. detailed check)

A test-check technique for obtaining audit evidence by examining a subset of a population. Statistical sampling draws the sample using objective, probability-based criteria and allows results to be generalized to the whole population, whereas non-statistical sampling relies on the auditor's experience and judgment. A test check (examining only part of the population) is distinguished from a detailed check (examining every item), and the choice between them depends on the level of risk and the availability of tools such as generalized audit software.

Sampling and encoding

Digitizing an analog signal (A/D conversion) has three stages: sampling → quantization → encoding. Sampling extracts values at fixed intervals (the sampling period); by the sampling theorem the sampling frequency must be at least twice the signal's highest frequency to avoid aliasing. Quantization rounds each sampled value to a discrete level. Encoding then maps each quantized value to a binary bit pattern.

Sampling method (grid/random/Bayesian)

How a sweep picks configurations from the search space: grid (exhaustive), random (broad and fast), and Bayesian (learns promising regions from prior results).

Sampling theorem (Nyquist theorem)

A theorem stating that when an analog signal is sampled to be digitized, it can theoretically be perfectly reconstructed if the sampling frequency is at least twice the highest frequency component present in the original signal. Violating this causes aliasing, distorting the waveform, so a low-pass filter to remove high-frequency components before A/D conversion is a necessary design element.

Samsung Knox Mobile Enrollment

Samsung's own bulk-deployment service that registers Samsung Android devices in the Knox portal so they auto-enroll into Intune and configure at first boot. It plays a similar role to Google Zero Touch, but integrates with Samsung-specific Knox security features.

Sandbox (malware analysis)

A mechanism that safely runs an unknown executable — such as an email attachment — inside a virtual environment (sandbox) isolated from production, to check for suspicious behavior before it can cause harm. Its value is that even malware that slips past pattern-matching detection can be observed in a harmless environment before execution; however, sandbox-evading malware that detects it is running inside a sandbox and disguises its activity is an emerging challenge.

Sandbox environment

A non-production environment for dev/test; can be reset or copied to try changes without affecting production.

SAP Central Services (SCS/ASCS)

A core SAP component hosting the message server and enqueue server. As a likely single point of failure, it is made highly available via Pacemaker clustering.

SAP Deployment Automation Framework (SDAF)

A framework that builds an entire SAP system (VMs/OS/SAP-DB config) reproducibly with Terraform and Ansible. Its role differs from Azure Center for SAP solutions (build vs operate/manage).

SAP Landscape Management (LaMa) connector for Azure

A connector that operates Azure VMs/storage (start/stop, copy/refresh, etc.) from SAP LaMa. It controls Azure SAP-initiated—opposite direction from the Azure-initiated Azure Center for SAP solutions.

SAP Quick Sizer

An SAP-provided sizing tool for new (greenfield) environments. It estimates resource needs for new SAP/HANA and feeds Azure certified-VM selection. Existing systems are estimated from measured SAPS.

SAP-certified VM

An Azure VM SKU certified by SAP for support. Choose it by sizing to SAPS/HANA memory requirements. Non-certified SKUs are unsupported, so always verify against the certification list and SAP Notes for production SAP.

SAPS (SAP sizing metric)

SAP Application Performance Standard, a unit of SAP processing capacity. Size Azure VMs from the existing system’s SAPS and HANA memory requirements; estimate greenfield builds with SAP Quick Sizer.

SARIF

The Static Analysis Results Interchange Format. Uploading a third-party SAST’s SARIF to GitHub surfaces results as Code Scanning alerts in one UI, coexisting with CodeQL.

SASE (Secure Access Service Edge)

A concept that integrates network functions (such as SD-WAN) and security functions (SWG, CASB, zero-trust network access) in the cloud so that users and devices can access resources securely from anywhere under consistent policy. It supports the shift from perimeter defense to cloud-centric defense.

Savings Plans types

Purchase options giving discounts for a 1- or 3-year usage commitment. Compute Savings Plans are most flexible (EC2/Fargate/Lambda, across Regions/families); EC2 Instance Savings Plans lock to a family/Region for deeper discounts. More flexible than RIs.

SBOM (Software Bill of Materials)

A "bill of materials" listing included dependencies/versions in standard formats (SPDX, CycloneDX). Exportable from the dependency graph for compliance and supply-chain transparency (not a vulnerability list itself).

Scalability

Adjusting capacity to demand; scale up = vertical (bigger machine), scale out = horizontal (more machines).

Scale set autoscaling

Automatically scales a virtual machine scale set’s instance count by metrics (e.g., CPU) or schedule, with scale-in/out rules and min/max bounds.

Scale-in

Reducing the number of servers when load drops, to cut wasted cost—the counterpart operation to scale-out. In autoscaling, scale-in triggers automatically once a metric (e.g., CPU utilization) falls below a threshold.

Scale-out

Increasing processing capacity by adding more servers—horizontal scaling, as opposed to scale-up (vertical scaling), which boosts a single server's specs. It pairs well with stateless servers lined up behind a load balancer.

Scale-up / scale-down

Adjusting processing capacity by increasing or decreasing an individual server's specs (CPU, memory, etc.): scale-up raises capacity, scale-down lowers it. This contrasts with scale-out/in, which changes the number of servers.

Scan types (Seq Scan / Index Scan / Bitmap Scan)

The main scan methods the planner chooses among. Seq Scan walks the entire table in order (favorable when many rows qualify or no index applies). Index Scan uses an index to access rows efficiently. Bitmap Index Scan combines results from multiple index conditions into a bitmap, and Bitmap Heap Scan then accesses the heap in page order based on that bitmap, reducing random I/O.

schedule (cron)

A trigger for periodic runs via a cron expression; cron is UTC-based with minimum-interval limits and load delays, and stops if the repo is inactive.

Schedule performance index (SPI)

An earned value management (EVM) metric that evaluates schedule performance. SPI = EV (earned value) ÷ PV (planned value); 1.0 means on schedule, below 1 indicates a schedule delay, and above 1 indicates ahead of schedule.

Schedule variance (SV)

A metric computed as SV = EV minus PV that indicates whether the schedule is ahead or behind plan. A positive value means the project is ahead of schedule and a negative value means it is behind, and mixing up the sign leads to the wrong corrective-action decision.

Scheduled cloud flow

A cloud flow that runs on a schedule (daily, weekly); used for recurring reports or periodic checks.

Scheduled queries

A simple BigQuery feature to auto-run the same query (e.g., aggregation) on a schedule; complex dependencies use Cloud Composer.

Scheduled refresh

A setting to periodically refresh Import models; on-prem/VNet sources need an on-premises data gateway.

Schedules and event-based triggers

How pipelines start: schedules run at set times; event-based triggers fire on events like file arrival.

Schema

A namespace within a database that logically groups tables and other objects. The search_path setting specifies the order of schemas searched when resolving unqualified object names.

Schema Conversion Tool (SCT)

A tool that converts schema and stored procedures for heterogeneous DB migrations (e.g., Oracle → Aurora PostgreSQL), reporting what cannot be converted. Unnecessary for same-engine moves, where DMS alone suffices.

Schema registry

Centrally manages stream/message schemas and enforces compatibility (backward/forward) to prevent breaking changes between producers and consumers. Glue Schema Registry is the typical one.

SCIM (provisioning)

Syncs IdP user create/update/delete to GitHub, auto-provisioning/deprovisioning accounts. A user disabled in the IdP is auto-removed from GitHub, preventing leftover access—distinct from SAML (authentication).

SCM (Supply Chain Management)

A management approach that shares information across companies along the chain from raw-material procurement through production, distribution, and sales, optimizing the whole to reduce inventory and shorten lead times.

Scope creep

The uncontrolled expansion of project scope without going through a formal change control process. Because added work escalates without its cost and schedule impact being assessed and approved, it is important to enforce integrated change control and detect early signs promptly.

Scope tags (Intune)

A delegation mechanism that tags objects (policies, apps, devices) so only admins whose role is scoped to that tag can manage or view them. Used by large organizations wanting to split administration by region or department—narrowing the target scope on top of RBAC role permissions.

Scope verification (validate scope)

The process of formally confirming with the customer or sponsor that completed deliverables meet requirements and obtaining their acceptance. Unlike quality control, which checks technical correctness, this focuses on the acceptance question of whether deliverables satisfy the agreed scope.

Scoring script (init/run)

The script implementing inference in a deployment: init() loads the model and run() handles each request. It may be unnecessary for MLflow models.

SCP allow-list strategy

An SCP approach that removes the default FullAWSAccess and explicitly enumerates only allowed actions—strict, but heavier to manage since a missing allow can block legitimate actions.

SCP deny-list strategy

An SCP approach that keeps the default FullAWSAccess and only Denies the actions you want to forbid—flexible and the most common. SCPs are a permission ceiling and grant nothing (effective = SCP ∩ IAM).

SCRAM-SHA-256

A password authentication method specifiable in pg_hba.conf. It uses a challenge-response scheme so the password is never sent in plaintext or as a raw hash, making it more secure than the md5 method. It is the recommended default since PostgreSQL 10.

Screen

One page of a canvas app where controls are placed; apps are composed by navigating between screens.

Script debugging (bash -x)

Ways to diagnose a misbehaving script: bash -x prints each executed command after variable expansion (an execution trace), and bash -v echoes lines as read.

Script injection

A vulnerability where embedding untrusted input (PR title, issue body) directly into a run: shell command lets an attacker’s command execute; mitigate by routing values via an env var with quoting, plus validation, least privilege, and vetted actions.

SD-Access

A Cisco intent-based networking architecture that builds a VXLAN-based overlay fabric on top of a physical-topology-independent underlay, with policy (who can access what, and how) defined centrally and automatically distributed from Catalyst Center. It reduces manual per-device CLI configuration while improving segmentation consistency and deployment speed.

SD-WAN

A technology applying SDN concepts to the WAN, centrally managing multiple links (leased lines, Internet lines, etc.) in software and dynamically steering traffic to the optimal path per application characteristics and policy, improving agility and cost-efficiency of inter-site WANs.

SDN (Software-Defined Networking)

An architecture that separates the control plane (routing decisions) from the data plane (packet forwarding); an SDN controller centrally computes routing with a full network view and distributes forwarding rules to switches via protocols such as OpenFlow, enabling centralized control and automation without per-device configuration.

Search algorithm

A procedure for finding a target value among many pieces of data. Representative examples are linear (sequential) search, which checks items one by one from the beginning, and binary search, which narrows sorted data by half each step; binary search finds the target faster.

Search function (Power Fx)

Extracts records whose text contains the entered string (partial match); used for search-box filtering.

Search qualifiers

Keywords like is:/label:/author:/assignee: that narrow a search by type/state/owner; multiple combine with AND.

Search space

The definition of which hyperparameters to tune and their candidate ranges (discrete choice, continuous uniform/loguniform, etc.).

Secondary CIDR block

A capability that assigns an additional CIDR block to an existing VPC after creation, expanding the available IP address space. The new range must not overlap the primary CIDR, and it is a common remedy for IP address exhaustion when there is no room to add subnets.

Secondary risk

A new risk that arises as a direct result of implementing a response to an existing risk. For example, subcontracting work to a supplier (a transfer strategy) can create a new supplier-management risk; evaluating such risks created by the response itself, rather than overlooking them, is important for keeping risk response complete.

Secret Manager

A managed service to securely store, retrieve, and rotate secrets (API keys, passwords, certificates); avoid embedding them in code.

Secret Protection

Formerly secret scanning. Detects/blocks secrets (API keys, tokens) committed or about to be committed. Enabled at repo/org. Since a leaked secret remains in history, revoking (rotating) the token is mandatory.

Secret scanning

Detects API keys/tokens in commits/pushes; push protection blocks leaks up front.

Secret scope (env > repo > org)

Secrets are scoped at org, repository, and environment levels; on name clashes the narrowest scope wins (env > repo > org). Limit which repos can use org secrets, and centralize shared credentials at org level for easy rotation.

Secrets Manager automatic rotation

Periodically auto-updates credentials (e.g., for databases) via Lambda to reduce leak risk and toil. RDS/Aurora support built-in rotation.

secrets: inherit

A setting by which a reusable-workflow caller forwards all of its secrets at once.

Secure AI Framework (SAIF)

A Google framework to systematically address AI-specific threats such as training-data poisoning, prompt injection, and model leakage.

Secure boot

A mechanism that verifies the digital signature of the bootloader or firmware at startup and allows only legitimate, untampered software to run. Because it refuses to boot even if an attacker has flashed unauthorized firmware, it serves as a foundational embedded-security mechanism for IoT devices with OTA update capability, preventing unauthorized code execution or device takeover.

Secure Web Proxy

A proxy that allowlists egress by URL/SNI; unlike Cloud NAT (general internet egress), it controls "where egress is allowed" at the application layer.

Secured Virtual Hub

A virtual hub with Azure Firewall embedded, centrally applying policy across hubs via Firewall Manager to inspect traffic centrally.

Security baseline (Intune)

A mechanism applying Microsoft's pre-defined bundle (template) of security-expert-recommended settings—for Windows, Edge, Defender for Endpoint, etc.—in one go. It saves the effort of picking every setting individually, serving as an industry-aligned starting point that can still be overridden setting by setting.

Security campaigns

A mechanism bundling like existing alerts across many repos for planned, bulk remediation to a deadline; combined with PR-based remediation and bulk alert management for large-scale risk reduction.

Security center (Workspace)

A security analytics dashboard in the Google Workspace Admin console; the security health page, investigation tool, and alerts help surface and remediate risk.

Security Command Center

The center of security posture management that centrally visualizes misconfigurations, vulnerabilities, and threats across the cloud.

Security Copilot agents in Intune

Uses AI in Intune to investigate threats, analyze device performance, and review/act on recommendations. Versus deterministic PowerShell/Microsoft Graph automation you write, its role is AI-assisted investigation/analysis/recommendations (review before applying).

Security dashboard and alert center

The security dashboard overviews the org security posture (sharing, spam, auth); the alert center receives notifications (suspicious logins, phishing) and links to the investigation tool. Different roles, used together.

Security group (AWS)

A virtual firewall controlling traffic at the instance (ENI) level; stateful (return traffic auto-allowed) and allow-rules only (no deny rules).

Security group (Entra ID)

A Microsoft Entra ID group used for resource access and license assignment. Distinct from a Microsoft 365 Group (which bundles collaboration resources).

Security group (environment)

Uses a Microsoft Entra ID group to restrict which users can access an environment, scoping membership per environment.

Security group referencing

Specifying another security group (instead of an IP) as a rule’s source/destination—e.g., allowing the ALB’s SG as the source on the web servers’ SG. No IP management as instances scale, and tier-to-tier traffic is defined securely.

Security Health Analytics and custom modules

A Security Command Center capability for cloud security posture management (CSPM) that auto-detects misconfigurations (public buckets, over-broad firewalls); add bespoke checks via custom modules. Prevention is custom org policies.

Security manager (role)

A role overseeing security policy, managing alerts, and approving exceptions; granted independently of code-write access, at least privilege to the right people.

Security Overview

A dashboard giving an at-a-glance view of security posture across an org/repo—enablement, open alerts, risk trends—for prioritization and coverage checks (it doesn’t remediate).

Security patch management

The organized process of managing patches issued for an OS, middleware, or applications, spanning vulnerability-information gathering, testing, deployment planning, rollout, and confirmation. Delayed application is a direct cause of exploitation via known vulnerabilities, so tight integration with the asset inventory is essential.

Security role (Dataverse)

A role bundling create/read/update/delete privileges per table/column/row in Dataverse, assigned to users or teams to enforce least privilege.

Security rulesets and enforcement boundaries

A mechanism defining and enforcing required features/checks/remediation SLAs org-wide; enforcement boundaries set scope (whole enterprise / specific orgs / repo sets). Works only when enforced, not merely defined; can enforce multiple pillars together (cross-suite).

Security Service Edge (SSE) / Global Secure Access

A concept inserting a cloud security layer between users and apps. Under Microsoft’s Global Secure Access, it includes Entra Internet Access (SWG) and Entra Private Access (ZTNA). Becomes Zero Trust when integrated with Conditional Access.

Security testing (SAST/DAST/SCA)

Vulnerability checks embedded in the pipeline. SAST = static source analysis, DAST = dynamic analysis of a running app, SCA (dependency scanning) = known OSS vulnerabilities, IaC/container image scanning = misconfig/image vulns. Place don’t-run checks left (early), dynamic checks right (post-deploy).

Security warnings (vulnerability filtering)

An aid that detects/suppresses dangerous-pattern suggestions (weak crypto, injection-prone code); not a replacement for dedicated scanning and validation.

Security-related laws and regulations

A collective term for Japan's principal laws governing information security, including the Unauthorized Computer Access Law, the Act on Protection of Personal Information, and the Unfair Competition Prevention Act (trade-secret protection). Exam questions in the management/legal domain probe what each law protects and which acts it regulates.

SECURITY.md

A file publishing a repository’s security reporting process (where to report vulnerabilities and the response policy), clarifying where finders should report.

Segregation of duties

A basic internal-control principle that prevents fraud and error by dividing a sequence of duties — such as approval, execution, recording, and custody — among multiple people rather than concentrating them in one person.

SELECT statement (WHERE/ORDER BY/GROUP BY/HAVING/DISTINCT/LIMIT/OFFSET)

The DML statement that retrieves data from tables. WHERE filters rows, ORDER BY sorts them, GROUP BY groups them, HAVING filters groups, DISTINCT/SELECT DISTINCT removes duplicates, and LIMIT/OFFSET control the number of rows returned and the starting offset.

Self-help diagnostics / client health

Self-help diagnostics for Teams auto-checks common issues with guidance; client health shows client version/connection state in the Teams admin center. Detailed investigation uses client-side logs; light glitches use clearing the Teams client cache.

Self-hosted runner

A runner where you install and register the runner app on your own machine/cloud; for special hardware, internal-network access, or large caches. State can persist, so use on public repos is risky.

Self-join

An operation that references the same table more than once under different aliases and joins it with itself. It is used to trace hierarchical or corresponding relationships within one table, such as looking up a manager's name via an employee table's "manager" column.

Self-service password reset (SSPR)

An Entra feature letting users reset passwords without an admin, requiring multiple authentication methods and supporting password writeback to on-prem.

Semantic caching

A caching technique that reuses results for semantically identical queries (even if phrased differently) to cut unnecessary FM calls. A cache hit is determined by **the similarity of the query embedding vector**, unlike exact-match caching keyed on string match or deterministic hashes (e.g., prompt caching).

Semantic equivalence

That behavior is unchanged before/after refactoring or modernization; verified via tests to prevent "a working but different thing."

Semantic model

Power BI’s meaning layer (formerly dataset)—tables, relationships, measures, hierarchies, and formatting that reports reference.

Semantic model and DAX (measures, CALCULATE, storage modes)

Power BI’s meaning layer (formerly dataset). Composed of relationships (fact↔dimension typically one-to-many, single-direction), measures (aggregation expressions, lazy, not stored) and calculated columns (precomputed per row, stored—can bloat), plus hierarchies/formatting. DAX (Data Analysis Expressions) evaluates via row and filter context, with CALCULATE the core for modifying filter context (used with FILTER/ALL/USERELATIONSHIP; TOTALYTD/SAMEPERIODLASTYEAR for time intelligence). Storage modes: Direct Lake (load OneLake Delta directly into memory—fast and near-live; falls back to DirectQuery if conditions unmet), Import (fastest; needs refresh schedule), DirectQuery (always live; slower). The VertiPaq columnstore engine compresses/aggregates fast.

Semantic model refresh (monitoring)

Reloading data into a Power BI semantic model; monitor failures/duration—refresh behaves differently with Direct Lake.

Semantic ranker and vector search

A semantic ranker that reorders results by meaning, and vector search that finds similarity via embeddings. Combining both with keywords (hybrid search) improves RAG quality.

Semantic versioning (SemVer)

A version-numbering convention with three parts, MAJOR.MINOR.PATCH, that communicates the nature of a change. MAJOR signals breaking changes, MINOR signals backward-compatible feature additions, and PATCH signals backward-compatible bug fixes. It's the common language for package management and API compatibility decisions.

Semaphore

A mechanism for controlling concurrent access to a shared resource by multiple tasks (processes). It uses a counter representing the number of available resources, managing exclusive access through P (acquire) and V (release) operations.

Semi-structured data

Data structured by tags/keys but not bound to a fixed schema; flexible. E.g., JSON, XML.

Sender domain authentication (SPF/DKIM/DMARC)

The three pillars of sender domain authentication. SPF lists which IPs may send for a domain; DKIM cryptographically signs mail to prove it's unaltered and from the claimed source; DMARC declares a policy (quarantine/reject) based on SPF/DKIM results plus where to send reports. Set via TXT records to fight spoofing/phishing, and it strongly affects spam filtering on the receiving side, including Google Workspace.

Sensitive Data Protection (Cloud DLP)

A service that automatically discovers, classifies, and masks sensitive data such as PII in stored data.

Sensitive data protection (PII / masking)

Protecting sensitive data such as PII (personally identifiable information) and PHI: discover/classify with Macie, then protect via encryption, access control, and minimization. Masking/tokenization hides values, and handling varies by data classification; also prevent sensitive data leaking into logs.

Sensitivity labels

Classify data and apply protection (encryption, usage limits); labels travel with the file, persisting outside the org.

Sensors and actuators

A sensor converts a physical quantity (temperature, light, acceleration, etc.) into an electrical signal as input. An actuator does the reverse: it receives a signal and drives a motor, valve, or similar to produce physical action as output. IoT systems pair the two—sensing state, deciding/controlling, then acting on the environment via actuators.

Sentiment analysis and opinion mining

Sentiment analysis scoring text as positive/negative/neutral, and opinion mining extracting opinions per target (aspect).

Sentinel analytics-rule types

Four types: scheduled (flexible periodic KQL, most detection), near-real-time (NRT, ~1 min), threat intelligence (match ingested IOCs against logs), and machine learning (Fusion correlates multistage attacks). Anomalies (deviation from normal) complement them.

Sentinel Graph

Analyzes relationships between entities (users/devices/IPs) as a graph across org-wide data aggregated in Sentinel, revealing cross-cutting connections hard to see in single-table KQL.

Separation of duties

A design principle that avoids concentrating powerful privileges in one person—e.g., separating requester and approver—to prevent unilateral abuse/error; used with least privilege.

Sequence

A database object that generates a unique sequential number on each call, commonly used for auto-incrementing primary keys, created with CREATE SEQUENCE.

Sequence diagram

A diagram showing, in time order, which messages (such as API calls) pass between multiple systems or components. Vertical lifelines represent each participant, and horizontal arrows represent calls and responses. It is used to read or communicate the flow of a process that involves API calls.

Serializability

The property that the result of executing transactions concurrently matches the result of running them one at a time in some serial order. The SERIALIZABLE isolation level guarantees this property and is the strictest level, preventing every read anomaly — dirty reads, non-repeatable reads, and phantom reads.

Serverless (FaaS)

No server management; code runs only on events and bills only for execution (e.g., AWS Lambda).

Serverless compute (Azure SQL)

An Azure SQL compute tier that auto-scales by usage and auto-pauses when idle to stop per-second billing. It suits intermittent workloads.

Serverless vs provisioned (Cosmos DB)

The throughput-model choice. Serverless bills only consumed RU—good for intermittent/low traffic. Provisioned reserves RU/s for steady/high traffic, in manual and autoscale (auto-varies 10%–100% within a max) forms.

Service account

A special identity for workloads (VMs/apps) rather than humans; prefer short-lived tokens via metadata or Workload Identity Federation over downloaded keys.

Service asset and configuration management (SACM)

SACM (service asset and configuration management) manages, as an integrated whole, the service assets used to deliver a service together with their configuration information. It integrates the identification and management of assets with the management of configuration items (CIs) and the relationships among them, forming the basis for impact analysis and control of changes and releases. The IT service manager maintains the asset and configuration records as a single source of truth and designs processes to prevent divergence from reality, ensuring that decisions rest on trustworthy information.

Service catalog

A document listing the services currently in operation, corresponding to the live portion of the service portfolio. It commonly has two views: a business view showing content and how to request the service for users, and a technical view showing the supporting components. By keeping the catalog current, a service manager aligns what is presented to users with actual operations and uses it to receive requests and clarify scope of responsibility.

Service chaining (via NVA)

Sets the UDR next hop to an NVA (network virtual appliance/firewall) to force traffic through it; enable IP forwarding on the NVA and front it with an internal Load Balancer for redundancy.

Service connection

An authorization configuration allowing Azure Pipelines to access external resources (an Azure subscription, container registry, Kubernetes cluster, etc.). Created per project, a pipeline just references the service connection name to authenticate to the target; approvals and checks control which pipelines may use it.

Service containers (services:)

Spins up sidecar containers (DB, queue) only during a job; supports port mapping and health checks, enabling integration tests without an external DB.

Service Control Policy (SCP)

An organization-wide guardrail applied to accounts or OUs in AWS Organizations. It sets a permission ceiling so member-account IAM cannot exceed it (a maximum permission boundary).

Service desk

A single point of contact that receives inquiries and failure reports from users. It removes the need for users to know multiple contacts and allows responses to be managed centrally.

Service desk and SPOC

The service desk acts as the Single Point of Contact (SPOC) between users and the service provider, centrally receiving inquiries and fault reports. Consolidating contact into one channel prevents users from being passed around and centralizes logging, status tracking, and ownership, improving response quality and user satisfaction.

Service desk structures

The deployment forms of a service desk: local desks placed at each user site; a centralized desk consolidating support in one place; a virtual desk logically unified regardless of physical location; and follow-the-sun, which hands off across sites in different time zones for 24-hour coverage. The choice weighs cost, coverage hours, and fit with language and local conditions.

Service endpoint

Routes subnet-to-PaaS traffic over the Azure backbone and lets the PaaS firewall allow that subnet; assigns no private IP (not reachable from on-prem). Service endpoint policies can restrict destinations.

Service health

Shows status, incidents, planned maintenance, and advisories in real time in the admin center (the "current state" vs the SLA "promise").

Service Health (Microsoft 365)

In the Microsoft 365 admin center, shows Microsoft-side service incidents/advisories (outage, degradation, planned maintenance) and configures notifications. Distinct from Network connectivity insights (your network path).

Service level management (SLM)

The process that continually drives the definition, monitoring, review, and improvement of service level agreements (SLAs). It measures achievement against agreed service level targets and, when shortfalls or changes arise, feeds them through review into correction or renegotiation. Through SLM a service manager keeps customer expectations balanced with delivery capability and checks that underpinning agreements such as OLAs and UCs support the SLA targets.

Service level objective (SLO)

The measurable target value of a service level agreed with the customer within an SLA. Availability, response time, recovery time, and similar are defined as concrete figures or thresholds so achievement can be judged objectively. A service manager sets SLOs that are both achievable and matched to customer value, measures attainment through monitoring, and uses trends toward shortfall as grounds for improvement or renegotiation.

Service lifecycle

The series of stages a service passes through from conception to retirement: planning, design, transition, operation, and improvement. Each stage's outputs feed the next, and insights from operation flow back through improvement into the next round of planning, forming a cycle. A service manager identifies which stage a service is in and decides the appropriate management activities and handovers to the next stage.

Service measurement, evaluation, and audit

A set of control activities that measures service quality and objective attainment through KPIs and metrics, evaluates the results, then verifies through internal and external audit that procedures and controls conform, and takes corrective action against deviations. Measurement is tied to SLAs and service objectives so that it provides a fact-based basis for improvement. The IT service manager designs the metrics to fit their purpose and, analyzing the root cause of nonconformities revealed by audit, drives corrective action and continual improvement to prevent recurrence.

Service mesh

An infrastructure layer that controls inter-microservice communication cross-cuttingly through sidecar proxies attached to each service. Without changing application code, it applies traffic management, retries, observability (distributed tracing), and security such as mutual TLS in one place. Architects consider it when the number of services grows and common control of communication becomes cumbersome.

Service model (IaaS/PaaS/SaaS)

Classification of cloud delivery: IaaS = infrastructure (VMs etc.), PaaS = app platform, SaaS = finished apps (Microsoft 365 is SaaS). The higher the model, the more the provider operates.

Service Quotas

A service to centrally view and request increases to AWS service quotas (limits), used to manage scaling ceilings in large designs.

Service reporting (service level reporting)

The activity of periodically reporting service level achievement and trends to customers and stakeholders. It compiles results against SLOs, incident and change volumes, improvement progress, and the like, presented at the agreed frequency and format. Through reporting a service manager ensures transparency, accounts for any shortfalls, and uses it as a forum for building the consensus that leads to the next review and improvement.

Service tiers and purchasing models (GP/BC/Hyperscale, vCore/DTU)

Settings that determine Azure SQL performance/availability/cost. Tiers: General Purpose (balanced, remote storage), Business Critical (local SSD, built-in replicas, low latency, read scale-out), Hyperscale (up to ~100TB, page servers separate storage, fast backup/restore). Purchasing: vCore (flexible, Azure Hybrid Benefit, reserved discounts—recommended) vs DTU (simple metric). Compute is provisioned or serverless (auto pause/resume for intermittent loads). Share capacity across many DBs with an elastic pool. Read scale-out is on BC/Hyperscale.

Service Trust Portal

A portal to obtain Microsoft’s audit reports, certifications, and compliance documents (verify the cloud-side compliance).

Service value chain (SVC)

The set of interconnected activities at the core of the SVS, comprising six activities: plan, improve, engage, design and transition, obtain/build, and deliver and support. For each demand these activities are recombined flexibly into a value stream that produces value. A service manager designs how the activities are linked for a given service request to build an efficient flow of value delivery.

Service value system (SVS)

The core ITIL4 concept describing how an organization as a whole takes demand and opportunity as input and produces value as output. Its center is the service value chain, surrounded by the seven guiding principles, governance, continual improvement, and practices. A service manager uses the SVS to view operations end to end—from demand to value—rather than optimizing individual activities in isolation.

Service-linked role

A predefined IAM role dedicated to an AWS service so it can act on other resources on your behalf. Its permissions are predefined and protected from accidental breakage (e.g., used by Auto Scaling, ELB, Config). Unlike normal roles, it’s restricted from deletion/editing.

SES deliverability (bounces/configuration sets)

Operations to keep email delivered: high bounce (undelivered) or complaint (spam-report) rates throttle sending. Configuration sets emit events (send/delivery/bounce/complaint) to SNS/CloudWatch for monitoring; DKIM/SPF/DMARC authenticate, and dedicated IPs/warm-up manage reputation.

Session (stateless architecture)

The state of an ongoing interaction with a user. Making servers "stateless" (not holding session data locally) means any server can handle a given request, making the system easier to scale out.

Session affinity

A load-balancer setting that keeps routing the same client to the same backend; used for stateful connections (stateless design is often preferable).

Session blocking

When one session waits on locks held by another. Identify long blocks and deadlock signs via DMVs and resolve via queries, indexes, or isolation levels.

Session host

A Windows VM in Azure Virtual Desktop that delivers desktops/apps to users. It joins a host pool via a registration token and connects to clients through reverse connect (outbound 443).

Session key

A shared secret key freshly generated for each communication and discarded after that session ends. In TLS and IPsec, the session key is securely established using public-key cryptography or a key-exchange algorithm (e.g., Diffie-Hellman), after which the actual data is encrypted with fast symmetric-key cryptography. If a session key leaks, the impact is limited to that one session, not past or future ones.

Session Manager

Connects to an instance shell from the browser/CLI with no open ports and no bastion, logging activity to CloudTrail/S3.

Session Manager (port forwarding/audit)

Key points of shell access without opening SSH/RDP or ports: port forwarding tunnels securely from local to e.g. RDS; all sessions are recorded to CloudTrail/S3/CloudWatch for audit. It replaces a bastion host.

Session Persistence (Sticky Sessions)

Session persistence (sticky sessions) is a load balancer feature that consistently routes all requests from a given client to the same backend server, implemented via methods such as source-IP-based binding or embedding a server identifier in a cookie. It is needed for applications that store session state (e.g., login status) on the server side, where routing successive requests to different servers would cause state inconsistency.

Session policy

A temporary inline policy passed programmatically during AssumeRole that further narrows the assumed role permissions for that session (it can only restrict, never expand).

Session poolers (connection pools)

A mechanism that reuses established connections so many app connections do not exhaust the database. It reduces setup cost and stabilizes high concurrency; per-call connecting causes exhaustion.

SET / SHOW

SET changes a run-time parameter for the current session, while SHOW displays a parameter's current value. The current_setting() function can also retrieve a value.

Set function (global variable)

Stores a value in a global variable usable app-wide; manages values kept across screens.

Set operations (union, intersection, complement)

The three basic set operations. The union (A∪B) is the set of elements belonging to at least one of two sets; the intersection (A∩B) is the set of elements common to both; the complement (A^c) is the set of elements in the universal set that do not belong to a given set. They are visualized with Venn diagrams and underlie design and search logic that combine conditions.

Set operations (UNION/INTERSECT/EXCEPT)

Operations that combine multiple SELECT results as sets. UNION returns the union (removing duplicates by default; UNION ALL keeps them), INTERSECT returns the intersection, and EXCEPT returns the set difference.

Sets and Venn diagrams

A set is a collection of things that satisfy a certain condition. A Venn diagram uses circles to visually represent how multiple sets overlap or contain one another, making relationships such as union (either), intersection (both), and complement (the part not included) intuitive to grasp.

Settings Catalog (Intune)

A method that lets admins search and pick from every setting Intune exposes and freely combine them into a custom configuration profile. Unlike pre-templated profile types, it offers fine-grained flexibility by selecting only the settings needed from the catalog, and new OS settings are added over time.

setup-* actions

Official actions like actions/setup-node that provide a specified tool version at runtime; used when the preinstalled version is unavailable.

Seven basic quality tools

The collective term for seven quality analysis tools: Pareto chart, cause-and-effect diagram, control chart, histogram, scatter diagram, check sheet, and stratification. They primarily handle numerical data, and selecting the right tool for the purpose — from cause analysis to trend detection — is an important judgment skill.

SFP and PoE

An SFP (small form-factor pluggable) is a swappable optical/copper transceiver module that plugs into an expansion slot on a switch or router. PoE (Power over Ethernet) sends both data and electrical power over the same Ethernet cable, powering devices such as IP phones, access points, and security cameras without separate electrical wiring.

SHA (commit hash)

A unique identifier computed from a commit content; it uniquely identifies the commit.

SHA pinning

Referencing a third-party action via uses: owner/repo@<full commit SHA>; since tags are reassignable, an immutable SHA is safest against tampering. Avoid floating refs like @main.

Shared channels (Teams Connect)

Collaborate in a specific channel without joining the team or switching tenants, enabled when both sides allow B2B direct connect via cross-tenant access settings.

Shared computer activation (SCA)

A setting required to correctly activate Microsoft 365 Apps on multi-session session hosts where many users share one VM. Without it enabled, activation fails.

Shared drives

A team-owned Drive space; unlike personal My Drive, files remain with the organization as members change.

Shared lock and exclusive lock

The two basic lock types underlying concurrency control. A shared lock (S-lock) is for reading and can be held by multiple transactions at once, while an exclusive lock (X-lock) is for writing and, while held, blocks any other lock from being acquired.

Shared mailbox

Lets multiple people share one address (e.g., info@) without a license. Distinct from a Microsoft 365 Group (full collaboration set).

Shared responsibility model

Splitting security/operational duties between provider and customer; the boundary shifts by service model, and data, identity, and devices are always the customer.

Shared semantic model

Reusing one model across multiple reports; centralizes definitions and keeps metrics consistent (avoids duplicate rebuilds).

Shared VPC and custom-mode VPC

Shared VPC lets multiple projects share one VPC for centralized networking; a custom-mode VPC lets you design subnets and IP ranges yourself.

shared_preload_libraries

The configuration parameter that lists extensions (shared libraries) to load at server startup. Extensions that hook into the whole server process, such as auto_explain or pg_stat_statements, must be registered here, and editing postgresql.conf has no effect until the server is restarted.

SharePoint

The basis for team/org sites and document sharing; many people co-edit shared documents. Teams channel files are stored here.

SharePoint admin center

The dedicated admin center for SharePoint sites, libraries, and folders. Site roles (permission levels) control who can access what, and it is the starting point for oversharing remediation.

SharePoint Advanced Management and restricted site access

Restricted site access in SharePoint Advanced Management limits access to a specific site to allowed users only, reducing exposure through Copilot caused by oversharing.

SharePoint oversharing controls

Because Copilot inherits existing permissions, oversharing can surface sensitive data via Copilot. Use the data access governance report to find widely shared / sensitivity-labeled sites and remediate with restricted site access in SharePoint Advanced Management.

Sharing (Power BI)

A distribution method handing a specific individual item to a few recipients—chosen vs apps (organized to many) or workspace roles (development).

Sharing an app

Granting other users/groups access to an app—run permission for users, edit permission for co-owners—managed separately from data permissions.

Sharing economy

An economic model in which individuals or businesses share underused assets, such as cars, housing, skills, or goods, with others through an internet platform, typically via rental or lending. It spreads a consumption style of using assets only when needed rather than owning them, letting asset holders earn revenue from otherwise idle capacity. IT strategists consider whether a company's own idle assets or spare capacity could be turned into a matching service as a new business idea.

Sharing link

A OneDrive/SharePoint way to share a single up-to-date copy with set permissions (view/edit, org-only, expiring), avoiding duplicated attachments.

Shell (bash)

The interactive environment that interprets user commands and passes them to the kernel; the Linux default is bash. Its mechanics (variables, quoting, history, path resolution) underpin scripting and text processing.

Shell and environment variables

A shell variable is set with NAME=value (no spaces around =) and is valid only in that shell; export makes it an environment variable inherited by child processes. List with set (all) / env (environment only), remove with unset, print with echo.

Shell functions

A reusable part naming a routine: define with name() { … } or function name { … }; inside, $1 refers to the function own argument.

Shell scripts and the shebang

Automating a series of commands in a file; the first-line shebang #!/bin/bash names the interpreter, and chmod +x grants execute permission to run it as ./script.sh.

Shell startup files (login / non-login shells)

A login shell (e.g., ssh login) reads /etc/profile then only the first of ~/.bash_profile, ~/.bash_login, ~/.profile; a non-login shell (a new terminal tab) reads /etc/bash.bashrc then ~/.bashrc. Put environment variables in the profile files and aliases/functions in .bashrc; on logout ~/.bash_logout runs.

Shift left

Moving security earlier in development to prevent problems before they grow—Push Protection, dependency scanning, pre-merge analysis. Later fixes cost more. Prevention doesn’t replace detection/remediation (use layers).

Shortest Path Problem

The problem of finding, in a weighted graph, the path from a start vertex to a destination vertex that minimizes the total sum of edge weights. It is solved with algorithms such as Dijkstra's algorithm (non-negative weights) or the Bellman-Ford algorithm (allows negative weights), and is applied in route planning, navigation systems, and network routing. Unlike plain breadth-first search, which only finds shortest paths in unweighted graphs, these algorithms account for edge weights.

showmount (list NFS exports)

A command to check which directories an NFS server exports and which clients have them mounted. `showmount -e servername` lists the exported directories on the target server.

Shutdown and reboot commands (shutdown/reboot/halt/poweroff)

Commands to safely stop or restart the system. shutdown is the canonical one, supporting scheduling (-h halt / -r reboot) and warnings to logged-in users; halt stops, reboot restarts, poweroff powers off.

Side-channel attack

An attack that infers secrets such as keys by observing physical side information (timing, power consumption, electromagnetic emissions, sound) rather than a theoretical weakness of the cryptography itself. Tamper-resistant implementations suppress such side-information leakage.

Sidecar pattern

Running an auxiliary container (log shipping, proxy, security) alongside the main container in the same task/Pod—adding cross-cutting concerns without changing the app. A service mesh (Envoy proxy) is a prime example.

SIEM

Security Information and Event Management: centrally collects logs and events from many sources (servers, network gear, apps) and correlates them to detect threats. Products like Microsoft Sentinel, Google SecOps, and Splunk fill this role.

SIEM (Security Information and Event Management)

A system that centrally collects logs from multiple sources — firewalls, IDS/IPS, servers, endpoints — and correlates them to surface attack indicators that would go unnoticed in any single log alone, raising them as alerts. It forms the core platform underpinning SOC monitoring work.

Sign-in issues

Failures to sign in to the Teams client stemming from the identity layer—authentication, token acquisition, MFA, or Conditional Access policy evaluation. Diagnosed by checking Entra ID sign-in logs for the block reason and policy name. Distinct in root-cause layer from join meeting issues (signed in but a meeting/feature fails).

Signals and terminating processes (kill / pkill / killall / pgrep)

Signals convey control to processes: the default SIGTERM (15) politely asks to terminate, SIGKILL (9) force-kills uncatchably, SIGHUP (1) means hangup/reload. kill takes a PID, pkill/killall take a name, pgrep finds PIDs by name.

Signature Version 4 (SigV4)

The standard way to sign AWS API requests with access keys: a signature computed from the request, timestamp, Region, and service detects tampering and prevents replay. SDKs/CLI handle it automatically; presigned URLs build on it.

Signed URL

A URL granting time-limited, scoped access to a Cloud Storage object without making it public; different from making a whole bucket public.

Silent source detection and SOC metrics

Silent source detection catches log sources that stopped sending data as expected (gone silent), preventing detection blind spots; measure SOC quality with KPIs like MTTD (mean time to detect) and monitor platform health with threshold alerts/notifications (Cloud Monitoring).

Siloing

A state in which data and business processes are fragmented by department or system, preventing information sharing and coordination across the organization. It tends to arise from excessive local optimization and becomes an obstacle to organization-wide data utilization and DX initiatives.

Silver layer

The middle medallion layer; cleansing, dedup, joins, and typing produce consistent, integrated data.

Single point of failure (SPOF)

A component whose failure brings down the whole system. Eliminated via multi-AZ placement, redundancy, load balancing, and automatic failover. The starting point of availability design is to find and remove SPOFs.

Single sign-on (SSO)

Signing in once to access multiple applications.

Single-user mode

An emergency recovery mode that accepts no normal client connections, allowing the server to be operated through a single local connection only. It is used to repair a broken system catalog or as a stopgap when the server cannot start normally. It is started with the postgres --single command and used to manually fix the system catalog or run VACUUM within a single transaction.

Site reliability engineering (SRE)

A Google-pioneered practice that runs operations with a software mindset and manages reliability via measurable targets such as SLOs and error budgets.

Site-to-site VPN (S2S)

Connects an on-prem site to an Azure VNet over a persistent IPsec tunnel; configure a VPN gateway and an on-prem local network gateway.

Site-to-Site VPN and Remote Access VPN

Site-to-site VPN establishes a persistent tunnel between VPN gateways at two locations so all devices behind them communicate transparently, while remote access VPN has individual client devices run VPN software to connect a single user into the corporate network. The former suits inter-site traffic; the latter suits telework and mobile access.

Six components of internal control (J-SOX implementation standards)

The internal control components defined by Japan's J-SOX implementation standards. It extends COSO's five components (control environment, risk assessment and response, control activities, information and communication, monitoring) by adding "response to IT" as a sixth, independent component. Auditors evaluate the design and operation of internal control over financial reporting against these six components.

Six pillars of Well-Architected

Axes for sound design: operational excellence (operations/automation), security, reliability (fault tolerance/recovery), performance efficiency, cost optimization, and sustainability (environmental impact). Reviewed via the Well-Architected Tool to surface risks.

Skewed Tree

A binary tree in which every node has only one child (either left or right), effectively degenerating into a linear list. This commonly arises when already-sorted data is inserted sequentially into a plain binary search tree, degrading search, insertion, and deletion complexity from the intended O(log n) to O(n). Self-balancing structures such as AVL trees or red-black trees exist specifically to prevent this degeneration.

Skillset and custom skills

A collection of skills applying AI enrichment (OCR, entity extraction, translation) during indexing. Custom processing is added as custom skills.

SLA (service level agreement)

A contract defining guaranteed uptime; if missed, you may be eligible for service credits (partial refunds).

SLA and composite SLA

A service level agreement (SLA) is an uptime commitment. Combining services in series makes the composite SLA the product of each, lowering overall availability—offset with redundancy.

SLA and SLM

An SLA (service level agreement) is a document agreed between a service provider and its users specifying quality targets such as uptime and response time. SLM (service level management) is the ongoing activity of monitoring and reviewing that agreement.

SLAAC and NDP (IPv6)

IPv6 address autoconfiguration. NDP (Neighbor Discovery Protocol) unifies IPv4's ARP and router discovery; routers announce prefixes via RA (Router Advertisement). A host combines the RA prefix with its interface ID to autogenerate a global unicast address (SLAAC = stateless address autoconfiguration), needing no DHCPv6 server.

Sleep mode

An operating mode that stops the clock to the CPU and, in some cases, power to peripheral circuits, maintaining a low-power state until a specific event such as an interrupt occurs. It does not reduce power as much as deep sleep, but its wake-up time is shorter, and choosing between the two matters for battery-life design in IoT devices that alternate between sensor measurement and standby in an intermittent operation pattern.

SLI (service level indicator)

A measured metric used in Site Reliability Engineering (SRE) to quantify reliability—success rate, latency, availability, etc., tied directly to user experience. It's continuously measured and compared against an SLO target to judge whether reliability goals are met.

SLO (service level objective)

The target value an organization sets for an SLI (e.g., 99.9% availability). Usually set more conservatively than the contractual SLA (service level agreement), and the risk of falling short is tracked via how much of the error budget has been consumed.

Slowly changing dimension (SCD)

How dimension attribute changes are handled: Type 1 (overwrite, no history), Type 2 (add rows to keep history), Type 3 (keep prior value in a column).

SMART (Self-Monitoring, Analysis and Reporting Technology)

A mechanism built into HDDs/SSDs that self-monitors health indicators (temperature, bad sectors, etc.) and reports signs of impending failure. smartd runs as a background monitor, while smartctl checks status and runs self-tests.

Smart factory (Industrie 4.0)

A factory that embeds IoT sensors, robotics, and AI-driven data analysis into its equipment and processes to grasp and optimize production in real time. It is one of the means of realizing the fourth industrial revolution championed by Germany's Industrie 4.0 national strategy, which also aims for mass customization, producing individually ordered items at costs comparable to mass production. IT strategists design initiatives that link shop-floor data to management decisions and demand forecasting, pursuing both higher productivity and flexible, high-mix low-volume production.

Smoothing and bursting

Mechanisms that level capacity use: bursting temporarily uses extra compute, and smoothing spreads that consumption over time; overload triggers throttling.

SMTP authentication (SASL)

A mechanism that authenticates the sender with a username and password when sending mail, using the SASL (Simple Authentication and Security Layer) framework to prevent unauthorized relaying (open relay) by third parties.

SMTP protocol

The protocol used to send mail between servers and from clients to servers (TCP port 25, etc.). MTAs such as Postfix use this protocol to deliver mail.

Snapshot

A point-in-time freeze of a filesystem or volume's state. LVM snapshot LVs and Btrfs snapshots are common examples; because only the changed blocks are tracked, creation is cheap, making snapshots useful for backups and rollback after a failure.

SNI (multiple certificates)

Server Name Indication: a TLS-handshake extension where the client presents the target hostname, so an ALB (and NLB TLS listener) can serve different ACM certificates by hostname—offering HTTPS for many domains from one load balancer.

SNMP

A protocol for monitoring and managing network devices. In addition to polling (GET) where the manager periodically queries agents, it has traps by which an agent proactively notifies on events. Management data is structured in a MIB (identified by OIDs). SNMPv3 adds authentication and encryption, resolving the plaintext-community weakness of v1/v2c.

SNMP Community String

In SNMP v1/v2c, the community string is a plaintext shared value used to authenticate requests between manager and agent, with read-only and read-write permission levels; requests lacking the correct community string are rejected by the agent. Because it is transmitted in cleartext, it is vulnerable to eavesdropping and guessing, so environments requiring confidentiality should migrate to SNMPv3's user-based authentication and encryption.

Snowflake schema

A design that further normalizes dimensions into multiple tables; more joins and usually lower BI performance than a star schema.

SNS fan-out and event-driven

Fan-out from one SNS topic to multiple SQS queues or Lambdas enables decoupled parallel processing. EventBridge routes events to many targets via rules.

SNS message filtering

Sets a filter policy on a subscription so only messages matching message attributes reach each subscriber—routing from one topic by condition and reducing unneeded downstream processing.

SOAR

Security Orchestration, Automation and Response: automates and orchestrates the post-detection response (investigation, containment, notification) to alerts from a SIEM via playbooks, cutting analyst repetitive work and response time.

SOAR playbooks and case management

Google SecOps SOAR playbooks automate/orchestrate safe, routine response (enrich/isolate/ticket/notify); the case management lifecycle assigns response stages, sets escalation workflows, and assesses handoff effectiveness.

SOC metrics (time to detect, contain, and respond)

The core metrics used to gauge SOC effectiveness: time to detect (from when a threat occurs to when it is caught), time to contain (from detection to containment), and time to respond (from detection to completed response), among others. Shortening these is a primary goal of improving SOC operations.

SOC optimization

A Microsoft Sentinel feature that analyzes "unused ingestion cost" and "detection coverage gaps vs threats" and recommends data/rule optimizations, continuously improving cost efficiency and detection coverage.

Social engineering

A collective term for techniques that obtain confidential information by exploiting human psychology or behavioral habits rather than technical means. Common examples include impersonating a staff member over the phone (pretexting), watching someone type a password over their shoulder (shoulder hacking), and rummaging through trash for discarded documents (trashing). Because it cannot be blocked by technical controls alone, education and training are the primary countermeasure.

Socket and port inspection (ss/netstat/netcat)

Inspecting sockets and ports: ss lists sockets (netstat successor; ss -tlnp shows TCP LISTEN with the process), and netcat (nc) tests connections to any port (nc -zv host 443)—separating firewall drops from missing services.

Software testing phases (unit to acceptance)

The process of verifying developed software by progressively widening scope, generally proceeding unit testing (per component) -> integration testing (components combined) -> system testing (the whole system) -> acceptance testing (the client checks it meets requirements). Operational testing, which checks the software can withstand real operation in a production-like environment, is performed as part of system testing or just before acceptance.

SOLID principles

An acronym for five principles that make object-oriented design more maintainable and extensible: the Single Responsibility Principle (a class has only one responsibility), the Open/Closed Principle (open for extension, closed for modification), the Liskov Substitution Principle (subtypes are substitutable for their base types), the Interface Segregation Principle (do not force clients to depend on methods they do not use), and the Dependency Inversion Principle (both high- and low-level modules depend on abstractions). They guide a system architect in designing class structures resilient to change.

Solution (Power Platform)

A package bundling apps, flows, tables, etc., to move artifacts across environments (dev→test→prod); managed/unmanaged, the basis of ALM.

Solution business

A business model that sells not individual products alone but solutions to a customer's management or operational problems, combining hardware, software, and services. Its forms include cloud-based offerings such as SaaS/PaaS/IaaS and outsourcing arrangements that take over system build and operation as a whole.

Solution checker

A tool that statically analyzes apps/flows in a solution and flags performance, reliability, maintainability, and security issues; used as a quality gate before promotion.

Solution dependencies

Other components a solution’s components depend on; transport them in the correct order including dependencies.

Solution layers

When multiple solutions change the same component, layers stack and the top layer takes effect. Different from environment variables (externalize values).

SoR and SoE (systems of record / systems of engagement)

A system of record (SoR) is a stability-focused system that accurately records and manages core business data, such as accounting or inventory-management systems. A system of engagement (SoE) prioritizes fast, responsive value delivery at points of contact with customers or employees, such as mobile apps or social-media integration, and demands agility. When driving DX, IT strategists pursue overall optimization with a two-layer structure: keeping the robustness-critical SoR stable while building an SoE layer around it that can respond nimbly to change.

Sort / SortByColumns functions

Sort records by a column ascending/descending; controls list display order.

sort / uniq

sort orders lines (-n numeric, -r reverse); uniq removes adjacent duplicate lines (-c counts). Since uniq only compares adjacent lines, always sort first (sort | uniq -c). wc counts lines/words/chars (-l lines).

Sort stability (stable sort)

The property that, when two elements have equal sort keys, their relative order before sorting is preserved after sorting. Merge sort is a stable sort, whereas quick sort can be unstable depending on the implementation.

Sort-merge join

A join algorithm that first sorts both tables on the join column, then scans them in parallel, merging matching rows as it goes. It performs well on already-sorted (indexed) data and is used mainly for equality joins, providing stable performance on large sorted inputs (chosen versus hash join accordingly).

Sorting algorithm

A procedure for rearranging data into a defined order, such as ascending or descending by size. Examples include bubble sort, which repeatedly compares and swaps adjacent items; sorting data in advance enables efficient processing such as binary search.

Sorting algorithms (bubble, quick, merge sort)

A family of algorithms for rearranging data into a defined order. Bubble sort repeatedly swaps adjacent elements — simple but O(n^2); quick sort partitions around a pivot for an average O(n log n); merge sort uses divide-and-conquer to reliably guarantee O(n log n) while remaining stable.

source (dot command)

The . (dot) and source commands read a script into the current shell without creating a new process; used to apply config files (e.g., ~/.bashrc) without re-login.

Spaces (Copilot)

A place to bundle related code, docs, and instructions as shared context to give Copilot consistent context.

Spanner

A distributed relational database combining global strong consistency and high availability, ideal for global core systems.

Spanning Tree Protocol (STP)

A protocol that, when redundant paths (loops) form in an L2 network, elects the switch with the lowest bridge ID (priority + MAC address) as the root bridge and automatically blocks redundant ports to prevent loops and broadcast storms. RSTP is a faster-converging variant.

Spark (Copilot)

Quickly scaffolds an app from an idea.

Spark notebook

A notebook for distributed processing of large data with PySpark or Spark SQL; suited to complex transforms, ML, and iteration.

Spark performance optimization

Tuning Spark: starter/custom pools, partition count, skew mitigation, caching, and broadcast joins.

Spark SQL

Using SQL on Spark to transform/aggregate data; lets SQL-savvy users write large-scale processing from notebooks.

Spark structured streaming

Continuously processes streaming data in Spark with batch-like code; lets you write complex stream transforms in notebooks.

Spatial Analysis

An Azure AI Vision feature detecting people’s presence and movement in video to count people and capture spatial events like distance and entry/exit.

Spear phishing, vishing, smishing, and tailgating

Social-engineering techniques subdivided by the channel of deception. Spear phishing is phishing targeted at a specific person or organization; vishing uses phone calls (voice); smishing uses SMS text messages; tailgating is physically following an authorized person through a secure door without a credential of one's own.

Special care-required personal information

A category under the Act on the Protection of Personal Information covering data such as race, creed, medical history, and criminal record, which requires especially careful handling to prevent unjust discrimination or prejudice against the individual. Acquiring it generally requires the individual's consent, and it is subject to stricter protection than ordinary personal information.

Special permission bits (SUID/SGID/sticky bit)

Special permission bits: SUID (4000) runs as the file owner (e.g., passwd); SGID (2000) runs as the file group for executables, and on a directory makes new files inherit its group; the sticky bit (1000) lets only a file owner delete it within a directory (e.g., /tmp).

Specialty devices (Intune)

"Specialty devices" is an official Intune management category (Intune admin center: Devices > Specialty devices) for purpose-built devices distinct from typical PCs/mobiles, such as Teams Rooms, Microsoft HoloLens 2, and Surface Hub. Dedicated configuration profiles and app-delivery methods are provided, managing these purpose-built devices together, separately from ordinary platform-based (Windows/Android/iOS) device management.

Speech translation and speaker recognition

Speech translation converting audio to another language’s audio/text in real time, and speaker recognition identifying/verifying a person by voice.

Speech-to-Text

A pretrained API that converts speech into text, used for tasks like transcribing call-center audio.

Speech-to-text (STT) and custom speech

Speech recognition that converts spoken words to text. Custom Speech tailors recognition to jargon or accents to improve accuracy (distinct from custom neural voice on the text-to-speech side).

SPF Algorithm (Dijkstra's Algorithm)

Dijkstra's algorithm computes the shortest path from a source node to every other node in a weighted graph. Link-state routing protocols use it as the underlying theory for building a topology graph from collected link-state information and computing the shortest-path tree rooted at the local router.

SPI bus (SPI communication)

A synchronous serial communication standard built on clock, MOSI (master-to-slave), MISO (slave-to-master), and chip-select signal lines. It supports full-duplex communication and is faster than I2C, but each slave needs its own chip-select line, so wiring grows with the number of connected devices. It suits high-speed communication with sensors or flash memory.

Spiral model

A development process model that repeats cycles of requirements, design, implementation, and evaluation—interleaved with risk analysis—to incrementally raise product maturity. It blends waterfall rigor with iterative flexibility: each loop produces a prototype and reduces risk before proceeding to the next cycle.

Split-brain

A situation—caused by a network partition or a mistaken restart of the old primary, among others—where two primaries (old and new) accept writes simultaneously. It destroys data consistency and must be avoided at all costs; fencing (STONITH: forcibly isolating the faulty node) prevents dual operation, and afterward the old primary is correctly re-folded in as a standby via pg_rewind or similar.

Split-MAC architecture

An architecture in which 802.11 MAC-layer functions are split between the AP and the WLC over the CAPWAP tunnel. Time-critical operations such as beacon transmission and acknowledgments stay on the AP, while management functions such as authentication and roaming decisions are centralized on the WLC, letting many APs be centrally controlled without sacrificing wireless real-time responsiveness.

Spot Fleet

A mechanism that maintains a target capacity of Spot Instances (optionally mixed with On-Demand) across multiple instance types and AZs. An allocation strategy (e.g., capacity-optimized, lowest-price) auto-selects pools less likely to be interrupted, and automatically replaces capacity in another pool on interruption.

Spot interruption notice

A notice issued about 2 minutes before AWS reclaims a Spot instance's capacity. It can be received via an EventBridge event or instance metadata (instance-action), giving a grace window to checkpoint state or hand off work safely before interruption.

Spot VM

A Compute Engine VM offered at a deep discount in exchange for possible preemption; used for cost optimization of interruption-tolerant batch work.

Spreadsheet software and functions

Spreadsheet software is an everyday-use application for entering numbers and formulas into cells to tally, analyze, and create charts. A function is a ready-made calculation template; using functions such as SUM (total), AVERAGE, and IF (conditional branching) lets you express even complex calculations simply.

Sprint

A fixed-length timebox in Scrum (typically one to four weeks) during which planning, implementation, review, and retrospective all occur, producing a potentially releasable increment. The length is not extended mid-sprint; unfinished items roll over to the next sprint.

Sprint review and sprint retrospective

Both occur at sprint end but serve different purposes. The sprint review shows the completed increment to stakeholders to gather feedback and adjust the product backlog. The sprint retrospective is an internal team session where the team examines its own process, tools, and collaboration to identify improvements for the next sprint. The key distinction is external feedback on the product versus internal process improvement.

SQL

The language for relational databases; split into DDL/DML/DQL=SELECT/DCL.

SQL analytics endpoint

An auto-generated, read-only T-SQL query endpoint over a lakehouse’s tables (no writes); distinct from a Warehouse’s full T-SQL.

SQL auditing (server/database)

Records database events to Log Analytics, Storage, or Event Hubs. Server audit applies to all DBs; database audit applies individually.

SQL authentication

Traditional authentication where the username/password are managed within SQL. A fallback when Entra auth is unavailable, requiring strong passwords and least privilege.

SQL data classification

A strategy that labels columns with sensitivity and information types to identify and surface sensitive data, combined with auditing to govern its handling.

SQL injection

An attack technique that injects malicious SQL fragments into a web application's input fields to manipulate or view a database in unintended ways. It is prevented by using bind variables (placeholders) and validating input values.

SQL JOIN

An SQL operation that combines rows from multiple tables based on a related column, producing a single result set. The main forms are inner join, which returns only matching rows from both tables, and outer join, which preserves all rows from one side.

SQL login

A server-level security principal in SQL Server/Azure SQL, responsible for authentication (whether one can connect to the server); database access is only granted once mapped to a user. Comes in two flavors: Microsoft Entra logins and SQL-authenticated logins.

SQL Managed Instance

A PaaS with near-full SQL Server compatibility; good for migrating existing SQL Server (lift-and-shift).

SQL Server Agent jobs

The job scheduler on VM/Managed Instance. Automates routine maintenance via jobs, steps, schedules, and operator notifications (absent in Azure SQL Database).

SQL Server connector

A connector to read/write existing SQL Server (on-prem/Azure) tables; on-prem may need a data gateway. Premium.

SQL Server on VM

Running SQL Server on IaaS; you manage down to the OS with full control but higher operational effort.

SQS long polling

An SQS receive mode that waits up to 20 seconds for a message before responding; it reduces empty receives, lowering request cost and noise, and is generally recommended. Set via WaitTimeSeconds.

SQS redrive (reprocessing from DLQ)

Moves failed messages parked in a dead-letter queue back to the source queue for reprocessing after fixing the cause (DLQ redrive). Messages exceeding maxReceiveCount move to the DLQ; used to isolate and recover from poison messages.

SQS short polling

The default SQS receive mode that responds immediately even when no message is available; fast to return but produces more empty receives, raising request count and cost.

SRAM / DRAM

SRAM holds each bit in a flip-flop, giving fast access but a larger cell size, higher cost, and lower density. DRAM stores each bit as charge on a capacitor, requiring periodic refresh, but achieves smaller cell size, lower cost, and higher density. Embedded systems typically use SRAM for caches and fast working memory, and DRAM for large main memory.

SSH

A protocol for securely logging in to and operating a remote server over an encrypted connection (TCP port 22); the standard for remote Linux administration.

SSH key files (authorized_keys / known_hosts / id_rsa)

Three files for SSH public-key authentication. The private key id_rsa and public key id_rsa.pub are created on the client; the public key is registered in the server authorized_keys. The client known_hosts records the server host key fingerprint and warns of a possible man-in-the-middle attack if it changes.

SSH key generation and management (ssh-keygen / ssh-agent)

ssh-keygen generates a key pair (-t ed25519 is the current best; RSA/ECDSA/Ed25519). A passphrase encrypts the private key file itself. ssh-agent holds decrypted keys in memory, and ssh-add registers them so the passphrase is entered only once per session.

SSH port forwarding

Tunneling other traffic through an encrypted SSH tunnel: local forwarding ssh -L local-port:target-host:target-port reaches an internal server (e.g., a DB) behind a firewall via a bastion; remote forwarding (-R) goes the other way.

SSID

The name (Service Set Identifier) that identifies a wireless LAN access point. A client selects the SSID to connect to and authenticates/encrypts (with WPA2/WPA3, etc.) accordingly. Disabling SSID broadcast can still be discovered by sniffing traffic, so it is not a security measure on its own.

SSL communication and pgcrypto

PostgreSQL can encrypt client-server communication via SSL/TLS (ssl=on plus certificate settings in postgresql.conf). pgcrypto is an extension that hashes/encrypts stored data itself (e.g. pgp_sym_encrypt()), providing a separate layer of protection from wire encryption.

SSL-VPN

A remote-access VPN using HTTPS (TLS/SSL). The clientless mode in particular needs no dedicated VPN software and works with just a web browser, easily limiting access to specific web apps mediated by the gateway. It suits limited access from unmanaged personal or contractor PCs.

SSM (Source-Specific Multicast)

A multicast model in which a receiver explicitly specifies both the group and the exact source it wants traffic from. It skips the RP-based shared tree entirely, building only a shortest-path tree straight to that source, avoiding the RP as a single point of failure and avoiding unwanted traffic. A receiver needs IGMPv3 to make that source-specific request. This SSM is an unrelated concept from AWS Systems Manager, which shares the same abbreviation.

SSM Automation (runbooks)

Runs operational tasks and auto-remediation via runbooks (defined procedures), automating fixes triggered by EventBridge or Config findings.

SSM Change Calendar

Defines open/closed windows for automation and patching on a calendar—blocking changes during peak or freeze periods (change freeze) and gating Automation/Run Command execution.

SSM Document

A JSON/YAML definition of actions Systems Manager runs. Types include Command documents (for Run Command), Automation documents (runbooks), and Session documents; both AWS-provided and custom exist.

SSM Inventory

A Systems Manager capability that collects metadata—installed software, applications, network configuration, and more—from managed instances into a central view. Collected data can feed Athena/QuickSight for compliance assessment and asset inventory.

SSM ops tools (OpsCenter/Fleet Manager/Distributor)

OpsCenter aggregates operational issues (OpsItems) and tracks remediation; Fleet Manager manages fleets via a GUI (files/registry/processes); Distributor packages and version-controls software (e.g., agents) for distribution.

SSM State Manager

A Systems Manager capability that defines an instance's desired configuration (OS settings, agents, scheduled tasks, etc.) and continuously, automatically enforces and remediates it. Defined as an association that runs on a schedule, reverting drift back to the declared state.

SSO (Stateful Switchover)

A high-availability mechanism on a device with a redundant supervisor (or a stack/VSS member), which continuously synchronizes state — configuration and some protocol state — from the active side to the standby side, so that if the active side fails, the standby takes over almost instantly with traffic continuing. It shares its abbreviation with single sign-on but is an unrelated concept about hardware redundancy.

Stack (LIFO)

A data structure in which the last item stored is the first one retrieved (LIFO: Last In First Out). Items are added and removed only from one end (the top). It is often likened to a browser's "back" history.

Stack and queue (abstract data structures)

Fundamental data structures that impose an order on inserting and removing data. A stack manages elements last-in-first-out (LIFO), and a queue manages them first-in-first-out (FIFO); both frequently appear as building blocks in pseudocode programs.

Stack policy

A JSON policy that protects specific resources from update/replace/delete during a stack update—guarding e.g. production databases from unintended changes. Distinct from IAM policies.

Staging (intermediate area)

An intermediate area holding ingested data before transformation; used to validate/shape before loading into production tables.

Staging area (index)

Where you place the changes to include in the next commit; added with git add.

Stakeholder engagement

The planned effort to identify a stakeholder current level of engagement (unaware, resistant, neutral, supportive, leading) and move them toward a desired target level. It is important as the basis for judging that stakeholders showing resistance require a particularly focused engagement strategy.

Standard ACL and extended ACL

A standard ACL matches only on source IP address, so placing it too far from the destination easily blocks unrelated traffic unintentionally, and best practice places it close to the destination. An extended ACL can also match on source/destination IP address, protocol, and port number, so it is placed close to the source to filter only the intended traffic as early as possible.

Standard streams (stdin / stdout / stderr)

The three streams every command has: standard input (0), standard output (1), standard error (2). Rewiring them with redirection and pipes is the basis of Linux text processing.

Standardization bodies (ISO and JIS)

Bodies that unify standards. ISO (International Organization for Standardization) establishes international standards such as ISO 9001 (quality management) and ISO/IEC 27001 (information security management). JIS (Japanese Industrial Standards) are Japan's domestic industrial standards, often enacted in alignment with international standards. The purpose of standardization is to ensure interoperability and facilitate transactions.

Standby modes (hot, warm, cold)

Approaches to how far a standby (backup) system is kept running in preparation for a primary failure. Hot standby keeps the standby continuously running and synchronized for immediate switchover (shortest cutover but highest hardware and power cost); warm standby has the standby booted but requiring some preparation such as data synchronization, an intermediate form; cold standby keeps the standby powered off and started on failure, giving the longest cutover but lowest cost. The architect selects a mode by balancing the required recovery time objective (RTO) against cost.

Star

Bookmarks a repository (saved to your Stars list) and signals interest; it does not notify you.

Star schema

A denormalized design placing dimension tables (analysis perspectives) radially around a central fact table; few joins, fast for BI.

Start VM on Connect

An Azure Virtual Desktop feature that powers on a stopped session host only when a user connects, cutting idle cost. It differs from autoscaling (which scales the whole fleet by demand); its purpose is on-demand power-on at first connect.

Starter workflow

A scaffold (template) for creating new workflows; placed under workflow-templates in the org .github repo for members to copy. Independent after copy—original updates don’t propagate.

Starvation

A condition in priority-based scheduling where a low-priority process or task is repeatedly preempted by higher-priority ones and never gets allocated the CPU or resource. It can be prevented by aging, which gradually raises the waiting process's priority.

State transition diagram (state machine diagram)

A diagram that represents the states an object or system can take and the transitions that move it from state to state on events. Each transition can associate a triggering event, a condition that must hold (guard condition), and the action performed, letting state-dependent behavior be defined exhaustively. It suits modeling control targets whose possible states are finite and well defined, such as embedded control or order progression.

State transition table

A table that exhaustively organizes, in matrix form, the states a system can be in and, for each state, the resulting state and action for every possible event. Compared with a state transition diagram, it makes it easier to cover every state-event combination without omission and to spot undefined combinations (unexpected events), which suits specification verification for embedded control software.

Stateful inspection

A firewall method that dynamically remembers the connection (session) state of passing traffic and automatically permits only the return packets corresponding to internally initiated communications. Unlike simple packet filtering, it needs no static rule for each return flow.

Stateless

Stateless describes processing each request or packet independently, without retaining or referencing prior communication state (connection or session information). Stateless packet filtering evaluates only each packet's header, making it fast and low-overhead but incapable of the session-context-aware controls that stateful inspection provides. From a load-balancing and scale-out perspective, stateless server design is advantageous because requests can be freely routed to any server without needing to preserve server-side state.

Statement of Applicability (SoA)

A document that specifies, for each control listed in Annex A of ISO/IEC 27001, whether it is applied or excluded in the organization and the rationale for that decision. It is drawn up based on risk assessment results and is a central artifact examined during ISMS certification audits.

States of data (in transit / at rest / in use)

The idea that the right protection depends on which state data is in. Data in transit (moving over a network) is protected with encrypted channels like TLS/IPsec; data at rest (stored on disk or storage) with disk encryption; and data in use (being processed in memory) with memory-protection measures.

Statistics (Warehouse)

Column distribution info the optimizer uses to pick efficient plans; stale/missing statistics cause slow queries.

Status badge

An SVG badge in the README that shows at a glance the latest result (pass/fail) of a workflow for a given branch/event.

Status light

The LEDs on a network device's ports. Their on/blinking/off state and color indicate link status (whether a link exists, its speed, and whether traffic is passing), providing the first clue when troubleshooting a fault.

Step

An individual task composing a job; run: executes a shell command and uses: invokes an action. Steps run top to bottom.

Step Functions (Standard/Express, ASL)

Defines workflows in Amazon States Language (ASL). Standard suits long-running, exactly-once with full history; Express suits high-volume, short-duration event processing, differing in billing and semantics.

Step Functions states (Map/Parallel/Choice)

Building blocks of a state machine: Task (work), Choice (branch), Parallel (concurrent branches), Map (iterate over array items; Distributed Map for large-scale parallelism), plus Wait/Pass/Succeed/Fail. Callbacks (.waitForTaskToken) wait for external completion.

Sticky learning (port security)

A port security configuration mode that automatically writes dynamically learned MAC addresses into the running configuration, thereafter treating them as permanently allowed addresses. It sits between manually entering each MAC statically and re-learning from scratch on every reload, reducing operational effort while retaining lasting control.

STONITH / fencing (fence agent, SBD)

STONITH reliably isolates (fences) a failed cluster node to prevent split-brain. On Azure it is implemented via the API-based Azure fence agent or a shared-block-device STONITH Block Device (SBD).

Storage access (access keys/SAS)

Ways to access Azure Storage: access keys (full account access, rotate them), SAS (shared access signature; delegated access scoped by target/operation/expiry—user delegation SAS is safest), and Entra ID + RBAC (key-free, recommended). Restrict to a VNet with private endpoints/firewall.

Storage account kinds and performance

General-purpose v2 (GPv2) is the standard handling Blob/File/Queue/Table. Performance is Standard (HDD) or Premium (SSD, low latency); Premium splits into BlockBlob/FileShare/Page kinds.

Storage devices (HDD and SSD)

Devices that store programs and data over the long term (auxiliary storage). An HDD reads and writes by spinning magnetic disks and is characterized by large capacity and low cost. An SSD uses flash memory and, having no moving parts, is fast, quiet, and shock-resistant, but tends to cost more than an HDD of the same capacity.

Storage engine vs formula engine

The two DAX engines: storage engine (VertiPaq, parallel, fast) and formula engine (single-threaded, often slow); over-reliance on the latter causes slowness.

Storage mode

How a semantic model stores/retrieves data—Import, DirectQuery, Direct Lake—chosen by the speed-vs-freshness trade-off.

Storage Transfer Service

A managed service to transfer large or continuous data into Cloud Storage; for small data, the gcloud/bq CLI is simpler.

Stored procedure (Cosmos DB)

Cosmos DB server-side JavaScript that processes multiple items within one logical partition as a transaction (ACID). You specify the partition key at execution; it cannot span logical partitions.

Stored procedure (Warehouse)

A reusable object bundling a sequence of T-SQL operations (multiple statements, control flow, parameters) to run in the warehouse. Commonly invoked from a pipeline activity to orchestrate data-transformation logic.

STP (segmentation, targeting, positioning)

A three-stage marketing strategy process: segmentation, dividing the market by attributes or needs; targeting, choosing which segment(s) to pursue; and positioning, deciding how the product should be perceived relative to competitors within the chosen segment. Strategists treat STP as the prerequisite step before designing concrete marketing measures such as the 4Ps or 4Cs, and in positioning they focus on whether the firm can claim an advantage on an axis competitors do not already own.

STP Port Roles (Root Port/Designated Port)

STP assigns each port a role to determine which ports actively forward traffic. The root port is the single port on a non-root bridge with the lowest-cost path toward the root bridge (exactly one per switch), while the designated port is the port responsible for forwarding traffic onto a given segment (one per segment). Ports selected for neither role become blocking, non-designated ports.

STP Port States (Blocking/Listening/Learning/Forwarding)

STP moves a port through a sequence of states before convergence to prevent loops while stabilizing the topology. Blocking receives BPDUs only, forwarding no traffic and learning no MAC addresses; listening sends/receives BPDUs to compute the topology but still forwards no traffic; learning begins building the MAC address table but still does not forward traffic; forwarding is the final state where the port both forwards traffic and learns addresses.

Strands Agents

An open-source SDK to build AI agents with minimal code, wiring models, tools, and prompts so an agent can reason and call tools.

Strangler fig pattern

An incremental technique to safely modernize a monolith. Place an API Gateway or ALB facade, carve out features one at a time into new services and re-point routing, then retire the monolith last—avoiding the high risk of a big-bang rewrite.

Strategy map (BSC)

A one-page diagram that visualizes the cause-and-effect chain among the Balanced Scorecard's four perspectives: financial, customer, internal business process, and learning and growth. It tells the strategy's story: improvements in learning and growth drive better internal processes, which raise customer satisfaction, which ultimately produces financial results. Strategists use the strategy map to explain an abstract business strategy as a consistent causal chain down to front-line KPIs, and to build organizational consensus around it.

strategy.matrix

Auto-expands one job definition into multiple variations (OS×version, etc.); add with include and drop with exclude.

Stream processing

Processing events as they arrive in near real time; for low-latency needs. E.g., sensor alerts.

Streaming / logical replication basics

PostgreSQL's replication mechanisms. Streaming replication sends WAL in real time to a standby for physical synchronization, while logical replication publishes and subscribes to changes as logical row-level modifications. Silver covers only conceptual basics (setup, monitoring, and troubleshooting are Gold-level topics).

Streaming replication config parameters (wal_level/max_wal_senders/synchronous_standby_names/synchronous_commit/hot_standby_feedback)

The core parameters for setting up streaming replication: wal_level=replica or higher emits the WAL volume needed for replication; max_wal_senders caps the number of concurrent walsender connections; synchronous_standby_names names the standbys used for synchronous replication; synchronous_commit determines how much synchronization is required before a commit is acknowledged; hot_standby_feedback keeps standby queries from blocking VACUUM on the primary.

Streaming replication error handling

When the connection between the walreceiver and walsender drops, the basic behavior (configuration-dependent) is to attempt automatic reconnection. For transient causes like a network blip, reconnecting is enough; but if the standby has fallen behind beyond the WAL retained by settings like wal_keep_size, reconnection alone cannot recover and a fresh base backup is required.

String functions (char_length/length/lower/upper/substring/replace/trim/`||`/LIKE)

Functions and operators for manipulating and matching strings: char_length/length return the character count, lower/upper change case, substring extracts part of a string, replace substitutes text, trim strips leading/trailing whitespace (or specified characters), the || operator concatenates strings, and the LIKE predicate does pattern matching (% matches any length, _ matches one character; a case-insensitive ILIKE also exists).

Strong consistency

A consistency model guaranteeing that a read after a completed write always returns the latest value. It typically costs more latency or throughput than eventual consistency, but is chosen where stale reads are unacceptable, such as inventory counts or balances. Consistency models are picked per use case based on this trade-off.

Structured data

Data with a fixed schema of rows and columns; typed, fast to search/aggregate. E.g., relational DB tables.

Sub-agent

A subordinate agent to which subtasks are delegated for large tasks/growing context, optimizing each agent’s context usage.

Subject groups (knowledge areas)

The collective term for the ten management domains defined by JIS Q 21500: integration, stakeholder, scope, resource, time, cost, risk, quality, procurement, and communication. Understanding that each subject group has activities spanning multiple process groups is important for grasping the overall structure of the PM standard.

Subnet

A smaller network range carved out of a virtual network address space; groups resources by purpose or public/private and serves as a unit for routing and access control.

Subnet delegation

Grants a specific PaaS service management rights over a subnet so it can auto-apply needed network config (e.g., NIC injection).

Subnet mask

A value marking the boundary between the network and host portions of an IP address (e.g., 255.255.255.0)—the dotted-decimal counterpart to a CIDR prefix length, still used in on-prem network gear and some cloud configuration screens.

Subnet reserved addresses

A rule where AWS reserves five addresses per VPC subnet—the first four (network address, VPC router, DNS, future use) and the last one (broadcast, unused in practice)—so they can't be assigned. A /24 subnet therefore has 251 usable addresses out of 256.

Subquery

A SELECT statement nested inside another SQL statement. One returning a single row and column is called a scalar subquery. Subqueries can also be used to test the presence or absence of results, as with NOT EXISTS, the negation of EXISTS.

Subscription (Azure)

The billing/usage boundary and a logical container for resources; often split by department or environment.

Subscription (seat) management

Managing Copilot seat assignment/removal and usage retrieval; automatable via the REST API in addition to the UI, used for onboarding/offboarding seat operations.

Subscription model

A revenue model in which a company charges customers repeatedly for the right to use a product or service over a period, rather than selling ownership outright in a single transaction. Because it generates continuous usage data, it makes changing customer needs easier to track, and managing churn rate and customer lifetime value (LTV) becomes central to success. IT strategists consider shifting from one-time sales to subscriptions to stabilize revenue and build an ongoing relationship with customers.

Subvolume (Btrfs)

A logical subdivision within a Btrfs filesystem that can be mounted or snapshotted independently. A single Btrfs filesystem can be split into multiple subvolumes, each with its own snapshots.

sudo / su (privilege escalation)

su switches to another user (su - to root). sudo grants privilege per command with an audit trail, safer than sharing root. Edit /etc/sudoers only with visudo (syntax-checked to avoid lockout).

Suggestion lifecycle

The loop: context change → prompt → model generates → present candidate → accept/reject → next suggestion with new context; accepted content influences the next context.

Summarization (extractive/abstractive)

Summarizes long text or conversations. Extractive summarization selects key sentences; abstractive summarization rephrases into new sentences.

Summary rules (Sentinel)

A Sentinel mechanism that pre-aggregates large raw logs into small summary tables, keeping frequent queries fast and low-cost. Distinct in role from analytics rules, which detect threats.

Superscalar and out-of-order execution

Superscalar CPUs have multiple execution units and issue several instructions per cycle to raise IPC. Out-of-order execution reorders independent later instructions ahead of stalled ones, filling pipeline gaps. Together they are pillars of modern high-performance CPU design.

Supervised learning

Learning from labeled data; includes regression (predict a number) and classification (predict a category).

Supply chain attack

An attack technique that infiltrates a target not directly but via a business partner, subcontractor, or the supplier of software/libraries it uses, where security is weaker. Typical examples include unauthorized access through a subcontractor or malware inserted into a software update. Assuring subcontractors' security levels through contracts and audits is a key countermeasure.

Supply chain management (security perspective)

An effort to make the entire supply network for a product or service visible — component suppliers, the software/OSS libraries used, even sub-subcontractors — and to assess and manage security risk at each stage. Maintaining a software bill of materials (SBOM) has recently gained attention as an effective tool for this.

Supply chain security

An umbrella concept for securing the software supply chain (dependencies and artifacts). On GitHub it encompasses the dependency graph, Dependabot (alerts and updates), dependency review, and SBOM export, covering transitive dependencies as well as direct ones.

Support and service requests

Service requests (support tickets) are opened from the Microsoft 365 admin center. Support plans like Unified/Premier differ in response times and scope.

Support bundle / diagnostics

A set of diagnostics GHES generates, provided to GitHub Support for investigating cases (outages, bugs, system failures).

Surrogate key

A system-generated integer key used as a dimension’s primary key, separate from the business key, to stabilize joins and ease history (SCD).

Swap

Disk space that temporarily holds data when physical memory runs short; initialize with mkswap and enable with swapon (disable with swapoff). One of the standard partition splits.

Sweep job (hyperparameter tuning)

A job that runs many trials with a search space, sampling, primary metric, and early termination to find the best hyperparameter configuration.

SWOT analysis

An analysis method that organizes a company's internal factors — strengths and weaknesses — alongside external environmental factors — opportunities and threats — to support the formulation of business strategy.

Symmetric-key cryptography

An encryption method that uses the same key (a shared secret key) for both encryption and decryption. Processing is fast, but the key must be shared securely with each communication partner, making key management increasingly complex as the number of partners grows.

Synapse components (SQL/Spark pools)

Azure Synapse Analytics unifies a dedicated SQL pool (provisioned DWH), serverless SQL pool (query the data lake), Apache Spark pool (big-data processing), and pipelines in one studio.

Synapse Spark / serverless Spark

Spark compute to interactively wrangle large data from notebooks, using an attached Synapse Spark pool or Azure ML serverless Spark.

Sync slicers

A feature linking slicer selections across multiple report pages, carrying a selection from one page to others.

Synchronous replication

Replication that waits for the replica to commit before acknowledging a write; zero data loss on failure (RPO 0) at the cost of higher write latency. Used by RDS Multi-AZ, etc.

synchronous_commit

A parameter controlling how much WAL durability is awaited before a commit is acknowledged to the client. With on (the default), it waits for a local fsync and, when synchronous standbys are configured, for the standby to flush (fsync) the WAL (remote_write waits only for the standby OS write, remote_apply waits for apply). Setting it to off improves performance but risks losing the most recent commits on a crash.

Synchronous/asynchronous replication

Synchronous replication gives RPO≈0 but adds write latency; asynchronous has lower latency but risks data loss on failure. Choose by RPO requirements.

Synthetic monitors

Actively and periodically probe endpoints/workflows from the user perspective (external monitoring); pair with passive monitoring to catch issues proactively.

Synthetic partition key

A partition key that concatenates fields (e.g., tenantId-date) or adds a random suffix to raise cardinality—used when a single field skews distribution. Distinct from a hierarchical partition key (multi-level split).

Syslog and Syslog Aggregation

Syslog is a protocol for sending device event and error logs, typically over UDP/TCP port 514, in a standardized format that includes facility and severity level. Aggregating logs from many devices onto a single syslog server enables cross-device correlation, chronological cross-referencing during incident investigation, and long-term retention for compliance; note that UDP delivery offers no retransmission guarantee, risking log loss.

System and hardware clocks (date / hwclock)

Linux keeps two clocks: the OS-maintained system clock (date/timedatectl) and the motherboard hardware clock (hwclock). hwclock --systohc writes system->hardware; --hctosys is the reverse.

System audit

An activity in which an independent auditor verifies and evaluates, from a third-party standpoint, whether an information system is operated safely and efficiently, and advises on improvements. Independence from the audited department is a precondition for the audit's credibility.

System audit execution phases (preliminary survey, main survey, follow-up)

After the audit plan is set, the execution phase begins with a preliminary survey that gathers overview materials—such as the audited organization's structure and how access rights are managed. The main survey follows, extracting and verifying concrete evidence such as actual logs and change records to identify issues. After the audit report, a follow-up later confirms whether the recommended corrective actions were actually implemented.

System audit process (plan, conduct, report, follow-up)

A system audit proceeds in the order plan → conduct → report → follow-up. Planning sets the objectives and scope; conducting the audit gathers evidence and evaluates it; the report communicates problems and improvement recommendations. Follow-up later confirms whether the recommended improvements were actually carried out.

System Audit Standards

A code of conduct issued by Japan's Ministry of Economy, Trade and Industry that governs how a systems auditor plans, performs, and reports an audit. It comprises general standards (auditor qualifications and independence), performance standards (planning and execution), and reporting standards, ensuring consistent audit quality. Auditors continually check their own procedures against this benchmark.

System catalog (pg_catalog)

The schema holding metadata in PostgreSQL's native format, storing information about every server object (tables, indexes, types, functions, privileges, etc.). Combined with system information functions such as current_database(), it lets you inspect internal state.

System Management Standards

A practice framework issued by Japan's Ministry of Economy, Trade and Industry describing how an organization should govern the planning, development, operation, and maintenance of information systems. It sets the benchmark that the audited organization is expected to meet, and the systems auditor uses it as the yardstick for judging observed practice. It must not be confused with the System Audit Standards, which govern the auditor's own conduct.

System on Chip (SoC)

A single semiconductor chip that integrates multiple functions a system needs — CPU, memory, graphics, communication interfaces, and more. It reduces board area, wiring delay, and power consumption, but changing functionality requires a chip redesign (mask revision). It is chosen for IoT devices and smart appliances that need high functionality in a small footprint.

System planning

In the Common Frame (SLCP), the planning process consists of drafting the systemization concept and drafting the systemization plan; this term refers to the latter. Taking business strategy and operational issues as input, it concretizes the scope, objectives, cost-effectiveness, project organization, and schedule, feeding the subsequent requirements-definition process — the most upstream phase of development.

System redundancy (dual and duplex)

Configurations that duplicate a system to guard against failure and raise availability. A dual system runs the same processing on two lines simultaneously and cross-checks the results, giving high reliability. A duplex system separates an active (primary) line used normally from a standby (secondary) line switched to on failure; standby readiness ranges over hot, cold, and other modes.

System routes

Default routes Azure auto-provides for intra-VNet, peering, gateways, and default internet; can be overridden by UDRs.

systemd / systemctl

The modern Linux init and service manager; it runs as PID 1 and starts services (units) in parallel by dependency (successor to legacy SysV init). systemctl is its control command (start/stop/enable/disable/status).

systemd journal (journalctl)

Binary-format logs collected by systemd, queried with journalctl (-u per unit, -b this boot, -f follow, -p severity, --since time range). It persists if /var/log/journal/ exists, otherwise memory-only (lost on reboot). Configure via journald.conf; trim old data with --vacuum-*.

systemd targets (default target / single-user mode)

Unit groups representing how far to boot: multi-user.target (CUI server standard), graphical.target (GUI), rescue.target (single-user mode). set-default sets the default from next boot; isolate switches now.

Systemization concept

The uppermost step in the Common Frame (SLCP) planning process, in which the target business scope and systemization aims are sketched in broad strokes based on business strategy and objectives. Whereas the subsequent drafting of the systemization plan concretizes scope, organization, schedule, and cost-effectiveness, the systemization concept establishes the underlying management intent and direction, agreed with executives beforehand. An IT strategist is responsible for drawing up a systemization concept aligned with business strategy and gaining executive approval before it is translated into a concrete plan.

Systems Manager Incident Manager

A service that coordinates major-incident response. It manages response plans, escalation plans, on-call schedules (rotations), and contact channels; auto-triggers runbooks on occurrence, pages stakeholders, and supports post-incident analysis.

T-SQL (Fabric)

The SQL dialect used in the warehouse and SQL analytics endpoint; suited to set-based transforms/aggregation, with read-write and transactions in the Warehouse.

Table (Dataverse)

The unit that stores data in Dataverse (a set of rows); standard tables (e.g., Account) and custom tables (your own); formerly called entities.

Table definition DDL (CREATE/ALTER/DROP TABLE, constraints)

DDL statements that define, modify, and remove tables. CREATE TABLE defines columns and constraints (PRIMARY KEY, FOREIGN KEY/foreign keys, UNIQUE, CHECK, NOT NULL); ALTER TABLE (e.g., ALTER TABLE ADD COLUMN) changes the structure; DROP TABLE removes the table.

Table formats (Iceberg/Hudi/Delta)

Open table formats that bring ACID transactions, upsert/delete, schema evolution, and time travel to S3 data lakes.

Table partitioning

Physically splits a large table via a partition function/scheme to make maintenance and queries efficient per range. Partition SWITCH swaps data in/out quickly.

Table permissions (Power Pages)

Controls which Dataverse table rows external visitors can read/write, combined with web roles; public does not mean fully open.

Table storage

Simple, inexpensive key-value (NoSQL) tables for large volumes of lightweight structured data.

Tablespace

An object that specifies which on-disk directory stores the physical data of tables and indexes. It lets objects within a single database be placed on different storage (e.g., fast disks versus high-capacity disks).

Tabular Editor

An external tool to edit semantic models efficiently; used to create calculation groups and run the Best Practice Analyzer.

Tabular Workflows

A feature that decomposes the tabular AutoML pipeline into components on Vertex AI Pipelines, letting you customize and reuse individual stages such as feature engineering or architecture search. Where plain AutoML is more black-box, Tabular Workflows targets advanced use cases needing fine control or scale over specific stages.

TACACS+

A Cisco proprietary protocol providing AAA for device administration (login and command authorization on network devices). It uses TCP, encrypts the entire packet, and treats authentication, authorization, and accounting as independent processes, in contrast to RADIUS, which uses UDP, combines authentication and authorization into one packet, and is used mainly for network access control.

Tag Editor

A console tool that searches existing resources across an account and lets you bulk-add, edit, or remove tags. It is used to retroactively enforce a tagging strategy or bulk-apply cost allocation tags, avoiding opening each resource individually to edit tags.

Tag policies (Organizations)

An Organizations feature that enforces standard tag keys/allowed values org-wide and detects non-compliant tags—ensuring the tag consistency that cost allocation and ABAC depend on. Distinct from SCPs (SCPs govern permissions; tag policies govern tags).

Tagging strategy

A consistent policy for applying key/value tags to resources—used for cost allocation (chargeback), automation (targeting), access control (ABAC), and inventory; enforced/monitored via tag policies, cost allocation tags, and Config.

Tags (Azure)

key=value labels on resources for cost reporting/organization and governance with Policy.

Tamper protection

A Microsoft Defender for Endpoint setting that blocks malware or attackers—even with local admin rights—from disabling real-time protection, stopping signature updates, or uninstalling Defender. It is commonly deployed and enforced tenant-wide via Intune security settings management.

Tamper resistance

The ability of an IC card or security chip (such as a TPM) to protect internal secrets (keys, etc.) against attempts at physical disassembly, observation, or alteration. It is an implementation property that makes reading out information or tampering difficult against side-channel and physical attacks.

TAP and SPAN

Both are ways to hand a copy of traffic to a monitoring tool. A TAP (test access point) is dedicated hardware physically inserted into the link that duplicates every signal on it exactly. SPAN (switched port analyzer, or port mirroring) is a switch feature that copies traffic from a chosen port to another port in software. SPAN can drop packets under heavy switch load, whereas a TAP, being dedicated hardware, essentially never does.

Target group attributes / deregistration delay

Settings for a target group’s behavior. Deregistration delay (connection draining) waits for in-flight requests to finish before removing a target; you also tune stickiness duration, slow start, healthy/unhealthy thresholds, and health-check interval.

Targeted attack

An attack that aims at a specific organization or individual, for example through a targeted attack email disguised as being related to the recipient's work, in order to steal confidential information or damage systems — unlike scattershot attacks aimed at an unspecified large number of targets.

Targeted-attack email drill

A training exercise in which employees are sent simulated targeted-attack emails that mimic real attacks, measuring open and click rates to raise awareness and reinforce response procedures. Results are aggregated to provide additional training for employees who opened the email and to reinforce the procedure for reporting suspicious mail.

Task (process) management

An OS function that manages tasks (processes)—the units of running programs. Each task transitions among three states: running (using the CPU), ready (prepared but waiting its turn for the CPU), and waiting/blocked (awaiting an event such as I/O completion). The OS dispatcher allocates CPU time to a ready task and switches between them using scheduling policies such as round-robin or priority, giving the appearance of running multiple tasks concurrently.

Task automation (SQL Server Agent, Elastic Jobs)

Routine-ops automation depends on the deployment. SQL Server Agent is the job scheduler on VM/Managed Instance (jobs, steps, schedules, operator notifications). Azure SQL Database lacks SQL Agent, so use Elastic Jobs (job agent + job DB; run T-SQL in parallel across DBs via target groups). Azure Automation runbooks (PowerShell/Python, Hybrid Workers) automate cross-cloud/on-prem ops. Schedule statistics updates, index rebuilds, DBCC CHECKDB, and backup verification, and notify on failure.

Task state transition

The set of states a task can occupy under an RTOS (running, ready, waiting/blocked, etc.) and the transitions between them. Only one task occupies the running state at a time; ready tasks wait for the scheduler to select them; and waiting tasks are blocked on an event or resource. Correctly understanding this transition model underlies root-cause analysis of faults such as deadlocks or priority inversion.

TCO (Total Cost of Ownership)

The total cost incurred across the entire life cycle of a system or service, from acquisition through operation, maintenance, and eventual disposal. It captures not just the initial investment (purchase or build cost) but also operating and maintenance costs, training, license renewals, and future migration or decommissioning costs, an evaluation lens emphasized because choosing a procurement option on low initial cost alone can overlook these later expenses.

TCO Calculator

A tool comparing an on-premises environment against migrating to Azure to estimate total cost of ownership (TCO) savings. Input on-prem line items (servers, storage, network, operational labor) to build a business case for cloud migration ROI.

TCP

A reliability-focused transport-layer protocol that establishes a connection (three-way handshake), guarantees ordering, and retransmits lost data. Used for HTTP, SSH, database connections, and anywhere data loss or reordering is unacceptable.

TCP/IP

A collective term for the standard suite of communication protocols used on the internet. IP handles routing that delivers data to its destination, while TCP ensures reliability through delivery confirmation and retransmission control.

TCP/IP model

A model that organizes communication into four simplified layers (application, transport, internet, network interface), compared with the OSI model. Real internet technology (TCP/IP) is built on this model, and in practice it is referenced more often than the OSI model.

tcpdump

A command-line tool for capturing and displaying packets. Unlike the GUI-based Wireshark, it runs from the CLI, making it well suited to investigating GUI-less servers or embedding in scripts. Its captures can also be saved to a .pcap file and analyzed later in Wireshark.

Team

A unit grouping members within an organization to grant repo permissions; can be nested, inheriting the parent.

Team archive

An action that puts a Teams team into a read-only state. Channel conversations and files remain viewable but new posts and edits are blocked. An option at archive time lets you also set the associated SharePoint site to read-only, but the underlying Microsoft 365 group itself remains active—membership management, for example, is still possible. Unarchive restores it to normal. Used when a project ends and you want to preserve the record while halting activity.

Team delete and restore

Deleting a team is carried out by deleting the underlying Microsoft 365 group. After deletion, it is soft-deleted and retained for 30 days by default, recoverable via restore in the Microsoft 365 admin center or PowerShell. After 30 days it is permanently purged and cannot be restored.

Team synchronization

Maps IdP groups to GitHub team membership and auto-reflects group changes into teams, centralizing group management in the IdP; can conflict with manually added GitHub members.

Team template

A blueprint to quickly deploy a team with a predefined channel/app structure. Distinct from creating from an existing group (inheriting members/resources). Template policies control which templates are available.

Teams admin center

The dedicated admin center for Microsoft Teams teams, channels, and policies. Policies control the scope of meetings, messaging, and apps.

Teams for VDI

Configuration that optimizes Teams audio/video media in virtual desktop (VDI) environments.

Teams media optimization (WebRTC Redirector)

A mechanism that improves Microsoft Teams audio/video quality in Azure Virtual Desktop by processing media on the local side, configured via the Remote Desktop WebRTC Redirector Service. Installing Teams alone does not optimize it.

Teams Phone

A cloud telephony capability that lets Microsoft Teams place and receive PSTN calls. Phone numbers are provided via Calling Plans, Operator Connect, or Direct Routing.

Teams usage reports

A set of aggregated usage reports available in the Teams admin center, visualizing Teams usage, user activity, device usage, app usage, and PSTN usage, among others. It reports on a different axis (volume/usage) than CQD (Call Quality Dashboard), which analyzes call/meeting audio quality trends.

Technology roadmap

A time-based visualization of future technology trends and a company's own technology-development plans. It is used in MOT (management of technology) to align R&D investment decisions with business strategy.

Technology S-curve

The idea that a technology's performance or adoption rate traces an S-shaped curve over time: a slow initial rise, a period of rapid improvement, and then a plateau as it approaches its physical or technical limit. Because the payoff from further investment in an existing technology drops sharply once it nears its limit, strategists use the position on the S-curve as a signal for when to shift investment to a discontinuous, next-generation technology instead.

Telnet and RDP

Protocols for operating a remote device. Telnet (port 23) is an older remote-login method that does not encrypt its traffic and is now deprecated; RDP (Remote Desktop Protocol, port 3389) provides graphical remote control of a Windows desktop.

tempdb configuration

A system DB used for temp objects, sorts, and the version store. Multiple data files and proper placement reduce allocation contention and optimize performance.

Template databases (template0 / template1)

Special databases that serve as templates for CREATE DATABASE. template1 is the default, user-customizable template that ordinary CREATE DATABASE statements copy; template0 preserves the pristine initial state and is used as the source when a clean copy (e.g., a different locale) is needed.

Temporary Access Pass (TAP)

A time-limited temporary credential used for passwordless onboarding or for re-registering users who lost an authentication method. Not a permanent authentication method.

Temporary credentials

Short-lived credentials issued by STS (access key, secret key, and session token); they auto-expire, so leak risk is lower than embedded long-term keys.

Tenant configuration (domains/Organization profile)

Tenant-wide basics in the Microsoft 365 admin center—adding custom domains (DNS TXT verification) and the Organization profile (name, contact, release preferences).

Tenant network

An isolated virtual network provided per tenant in a cloud environment; its traffic paths are separated from other tenants and access is further controlled with mechanisms like security groups.

Tenant settings (admin portal)

Settings where a Fabric admin governs tenant-wide feature availability (export, sharing, enabling specific features).

Terms of Use (ToU)

Terms requiring user acceptance as a condition of access. Integrated with Conditional Access and entitlement management so users cannot access without accepting.

Terraform (network automation)

An infrastructure-as-code tool that defines the desired infrastructure state in declarative configuration files and applies only the difference from the actual state. Through plugins called providers, it can manage resources on network devices and controllers in addition to the cloud, tracking applied results in a state file.

Test data method

A CAAT technique in which the auditor prepares test data with predetermined expected results, has it processed by the target program (or a copy of it) in a test environment separate from live data, and compares the output against the expected results to verify the correctness of the program logic. It focuses primarily on validating the program itself, and is normally run in a test environment to avoid contaminating live data—unlike the ITF method, which injects audit data into live production processing.

Test-driven development, agile, and waterfall

Test-driven development (TDD) writes the test before the implementation, then writes just enough code to pass it, building in quality from the start. Agile iterates through short cycles (sprints) of planning, building, and revisiting to adapt to change. Waterfall moves through requirements, design, implementation, and testing in one fixed direction, and suits projects whose requirements are already settled.

Text column

A column storing text; single-line or multiline, with configurable max length and format.

Text input

A control where users type text or numbers; configure format (text/number/password), default, and multiline.

Text preprocessing (tokenization/TF-IDF/n-gram)

Preprocessing to turn text into features: tokenization and stemming/lemmatization to normalize, then vectorization via bag-of-words, TF-IDF, n-grams, or Word2Vec.

Text search and extract commands (grep/egrep/fgrep/sed)

grep prints lines matching a regex (-i ignore case, -v non-matching, -n line numbers, -r recursive); egrep (grep -E) uses extended regex, fgrep (grep -F) does fixed-string search with no regex. sed is a stream editor, best known for sed 's/old/new/g' search-and-replace.

Text-to-speech (TTS) and SSML

Text-to-speech converting text to natural audio. SSML (Speech Synthesis Markup Language) controls pronunciation, prosody, and pauses, and custom neural voice creates a bespoke voice.

Text-to-Speech API

Google Cloud's pretrained API that converts text into natural-sounding speech across many languages and voices, used for IVR and read-aloud.

The CIA triad (confidentiality, integrity, availability)

The three fundamental elements of information security management. Confidentiality means only authorized people can access information; integrity means information is accurate and has not been tampered with; availability means information can be accessed whenever it is needed.

The four dimensions of service management

The four perspectives essential to delivering services and value effectively: organizations and people, information and technology, partners and suppliers, and value streams and processes. Neglecting any one dimension undermines the value of the service, so all must be examined in balance. A service manager assesses not only technology but also people, suppliers, and workflows when planning new or improved services.

The seven ITIL4 guiding principles

The universally applicable recommendations that guide behavior in ITIL4: focus on value, start where you are, progress iteratively with feedback, collaborate and promote visibility, think and work holistically, keep it simple and practical, and optimize and automate. They apply regardless of an organization's goals or structure. A service manager relies on them when improving services or making decisions, avoiding over-engineering and local optimization.

The small-files problem

Many tiny files slow reads; addressed by compaction via OPTIMIZE and proper partition design.

Theme (Power BI)

Formatting that applies colors/fonts across a report at once—distinct from conditional formatting (value-driven).

Theme (Power Pages)

Settings that define a site’s overall colors, fonts, and styles, letting you change the look to match a brand at once.

Thin client

A model that keeps almost no business processing or data on the client and instead concentrates processing on the server, transferring only the resulting screen. Because no information remains on the terminal, it strengthens leak prevention, and software updates and backups are managed centrally on the server, consolidating operations. In return, dependence on the server and network rises, making them the focus of single-point-of-failure and performance concerns.

Third-party Vault integration

Connecting to an external secrets manager (e.g., HashiCorp Vault) via OIDC and fetching credentials dynamically at runtime—avoiding long-lived storage in GitHub and reducing exposure.

Thrashing

A phenomenon where excessive multiprogramming causes frequent page faults, so most CPU time is spent on paging rather than actual processing, drastically degrading performance. It is addressed by tuning the degree of multiprogramming or adding memory.

Threat actor

A classification of who is behind an attack: low-skill thrill-seeking script kiddies, hacktivists pursuing a political message, financially motivated organized crime groups, nation-state actors running APT campaigns with state backing, and insiders who abuse legitimate access. Their capability and motive shape how defenders prioritize the risk.

Threat analytics (Defender XDR)

Threat reports from Microsoft security research about ongoing campaigns and new techniques—showing affected assets, recommended actions, and related detection/hunting queries—used to check whether your org is affected and to hunt proactively.

Threat and vulnerability

A threat is a potential cause of harm to information assets—such as unauthorized access, disaster, or human error—while a vulnerability is a weakness on the asset side that a threat can exploit, such as misconfiguration, unpatched software, or weak management. Risk is understood as the combination of the two: the possibility that a threat exploits a vulnerability to cause damage. Eliminating vulnerabilities makes risk less likely to materialize even when threats exist.

Threat hunting

Proactively seeking threats—rather than waiting for alerts—by forming testable hypotheses (from incident/threat intel/posture/behavior) and querying across logs (Logs Explorer/BigQuery/Google SecOps).

Threat modeling

A method to systematically analyze "where/how a system could be attacked" at design time. Surfaces threats to business-critical apps and bakes mitigations into the design (part of shift-left DevSecOps).

Threat protection and threat intelligence

Capabilities for detecting, analyzing, and responding to attacks. Microsoft Defender XDR unifies signals across domains to deliver extended detection and response (XDR).

Three categories of threats (human, technical, physical)

A classification of information-security threats by their source. Human threats arise from people — insider fraud, operational mistakes, negligence; technical threats use technical means such as malware or unauthorized access; physical threats come from physical harm such as disasters, theft, or destruction. SG places particular emphasis on managing human threats, including insider fraud and negligence.

Three generic strategies (cost leadership/differentiation/focus)

Michael Porter's classification of ways to win competitive advantage: cost leadership, which pursues the lowest cost across the whole industry; differentiation, which creates unique value to stand apart; and focus (cost focus or differentiation focus), which concentrates resources on a narrow segment. A strategist is expected to commit clearly to one of these given the firm's resources and target market, because pursuing several half-heartedly leads to being stuck in the middle, where the firm loses advantage on every front.

Three observability pillars (metrics, logs, traces)

Metrics (Cloud Monitoring, numeric trends), logs (Cloud Logging, events), and traces (Cloud Trace, request paths); correlate logs and traces by trace ID to pinpoint causes.

Three pillars of object orientation (encapsulation, inheritance, polymorphism)

Encapsulation bundles data and operations into a single object while hiding its internals; inheritance lets a new class take on the properties of an existing class; polymorphism allows the same operation call to behave differently depending on the object's type.

Three pillars of observability (metrics/logs/traces)

Three signals to understand a system from outside: metrics (numeric time-series for trends/alerts), logs (records of discrete events for root cause), and traces (a request’s path and latency for bottlenecks). On AWS, CloudWatch + X-Ray provide these.

Three-point estimate (PERT)

A technique that derives an expected estimate from three values: optimistic (O), most likely (M), and pessimistic (P). The PERT weighted average is calculated as (O+4M+P)/6, and because it incorporates uncertainty better than a single-point estimate, it is important for the estimate accuracy expected at level 4.

Three-schema architecture (ANSI/SPARC)

An architecture that splits a database into an external schema (per-user view), a conceptual schema (overall logical structure), and an internal schema (physical storage). Separating the layers lets one change without disturbing the others.

Three-tier web model

A system architecture that splits roles across three tiers: web server, application server, and database server. Each tier can scale independently, and the impact of changes stays contained within a tier.

Three-valued logic (handling NULL)

SQL comparison operators work under three-valued logic — TRUE, FALSE, and UNKNOWN — rather than plain boolean logic. Comparisons involving NULL generally evaluate to UNKNOWN, and a WHERE clause excludes UNKNOWN rows, which is why comparing against NULL requires IS NULL instead of an equality operator.

Throttling (capacity)

When sustained overuse of capacity causes delays/rejections; identify the cause in Capacity Metrics and resolve via optimization or scaling.

Throttling and retry (exponential backoff)

When API throttling returns 429, handle it with exponential-backoff retry.

Throughput

A performance metric expressing the amount of work a system can process per unit time, such as transactions per second or bytes per second of data transfer. It improves by increasing concurrency, adding hardware resources, or removing bottlenecks. The architect estimates the required peak throughput and designs a configuration with adequate capacity margin to meet it.

Throughput optimization (generative AI)

Optimization to raise generative-AI processing volume: efficient token processing, batch inference, concurrency management, provisioned throughput, and caching—maximizing work per unit time while avoiding throttling.

Time and materials contract (T&M)

A contract type that combines a unit rate for labor hours with reimbursement for materials actually used. It has characteristics between fixed-price and cost-reimbursable contracts, suiting small-scale work such as enhancements or maintenance where scope is hard to fix upfront, but without a cost cap it risks open-ended cost growth.

Time complexity and Big-O notation

An indicator of how an algorithm's running time or memory usage grows as a function of input size n. Expressed as O(1), O(log n), O(n), O(n log n), O(n^2), and so on, it is used to compare the efficiency of algorithms.

Time intelligence

Time-series DAX calculations (YoY, YTD, moving average) that rely on a date dimension (TOTALYTD, SAMEPERIODLASTYEAR).

Time zone (timedatectl)

Regional time settings; the data lives under /usr/share/zoneinfo/, configured by symlinking /etc/localtime to one. On systemd, timedatectl set-timezone Asia/Tokyo persists it, the TZ variable switches temporarily, and tzselect picks interactively.

Timeout design

A resilience basic that sets an upper bound on how long to wait for a response. Without one, a call can wait indefinitely on a failing dependency, exhausting resources like threads and connections and dragging the caller into a cascading failure. Layering progressively shorter timeouts down the call chain is the recommended pattern.

Timeout parameters (statement_timeout/lock_timeout/idle_in_transaction_session_timeout)

Timeout parameters that prevent runaway queries or lingering sessions: statement_timeout caps how long a single statement may run; lock_timeout caps how long to wait to acquire a lock; idle_in_transaction_session_timeout controls how long a session sitting idle inside an open transaction is allowed before it is forcibly terminated.

Timestamp

The last-modified/accessed/changed time of a file; touch updates it, and find -mtime can search by modification date.

TLS

A protocol that encrypts traffic and authenticates the server (and, when required, the client) via certificates. It performs key exchange and authentication in a handshake, then encrypts data with a symmetric key. Cloud load balancers and CDNs commonly terminate it, with certificates issued and renewed by a managed service.

TOAST

A mechanism (The Oversized-Attribute Storage Technique) that automatically compresses and splits column values larger than the page size (default 8KB) into a separate TOAST table. It transparently handles large variable-length values such as text or JSONB.

Toggle

A switch-style control toggling on/off; used to input boolean (yes/no) values—similar to a checkbox.

Toil

An SRE term for repetitive, manual operational work that could be automated. It creates no lasting value and, left unchecked, erodes engineers' capacity for other work. SRE practice sets a target share of operational time to spend automating toil away.

Token

The unit of text a model processes (roughly part of a word); basis for cost and context length.

Toolcache

A mechanism to check preinstalled language runtimes/tool versions on GitHub-hosted runners; consult alongside runner image release notes.

Topic (Copilot Studio)

A unit defining a conversation flow per user intent; started by trigger phrases and built from questions, messages, and branching.

Topics and subscriptions (Service Bus)

Pub/sub that fans one message to multiple receivers; each subscription can filter which messages it receives.

TOR (The Onion Router)

An anonymizing network that relays traffic through multiple nodes, layering encryption at each hop to conceal the true source. It is used legitimately for censorship evasion and privacy, but because it makes the source IP untraceable, it reduces a SOC's data visibility and can also serve as cover for attacker or malware traffic.

Total cost of ownership (TCO)

Total cost including not only hardware purchase but power, cooling, maintenance, operations staff, and refresh; used to fairly compare on-premises and cloud.

Total float

The maximum amount of time an activity can be delayed without delaying the overall project completion date (late start minus early start). The chain of activities with zero total float forms the critical path, and checking whether float is zero or positive is the basis for prioritizing responses to delays.

TOTP (time-based one-time password)

A possession-factor authentication method that generates a disposable passcode changing at a fixed interval (usually 30 seconds) from a shared secret and the current time. Widely used in smartphone authenticator apps, it forms multi-factor authentication combined with a password (knowledge factor).

Town hall

A large-scale, one-way broadcast event format for internal audiences, aimed at delivering information from presenters (e.g., all-hands meetings, executive announcements) rather than attendee interaction. It scales larger than a webinar (up to tens of thousands), with only a limited Q&A feature optionally enabled.

Toxic combinations

A Security Command Center concept: chains of configs/permissions that are low-risk alone but critical together (e.g., a public bucket + an over-privileged service account); evaluate to pre-empt attack paths.

TPM (Trusted Platform Module)

A tamper-resistant dedicated hardware chip that generates and stores cryptographic keys and records boot-configuration measurements into PCRs (platform configuration registers) to verify integrity (measured boot). It protects keys in isolation from software and is used for tasks such as disk-encryption key management.

Tracing to evaluate a flow

Recording (tracing) each flow step’s inputs/outputs, latency, and token usage to evaluate and improve quality and performance bottlenecks.

Traffic Mirroring

Copies actual packets passing through a source ENI and sends them to a monitoring ENI or NLB for deep inspection via IDS or packet capture. Whereas VPC Flow Logs are metadata only, Traffic Mirroring captures the payload (packet contents). Filters narrow the mirrored traffic, but mirrored bandwidth and cost apply.

Traffic Shaping and Policing

Shaping buffers and delays traffic exceeding a rate limit to smooth the output rate, avoiding drops at the cost of added latency, and is typically applied on egress. Policing instead drops or remarks (e.g., re-tags DSCP) excess traffic immediately without buffering, adding no delay but risking packet loss, and is typically applied on ingress to enforce a contracted rate.

Traffic split and blue/green

Place multiple deployments under one endpoint and split traffic by percentage. Roll out a new version gradually and roll back instantly on issues.

Transaction (BEGIN/COMMIT/ROLLBACK)

A mechanism that bundles multiple operations into a single indivisible unit. BEGIN starts a transaction, COMMIT finalizes all its changes, and ROLLBACK undoes them all. It guarantees the ACID properties (atomicity, consistency, isolation, durability), and SAVEPOINT lets you mark a point within a transaction to roll back to partially.

Transaction isolation level

A setting that determines to what extent concurrently executing transactions can see each other's uncommitted changes. From lowest to highest: READ UNCOMMITTED (allows dirty reads), READ COMMITTED, REPEATABLE READ, and SERIALIZABLE (the strictest level, equivalent to serial execution). Raising the level improves consistency but reduces concurrency (throughput) — a fundamental trade-off.

Transaction log (before/after image)

History data that records database updates and is used to recover from failures. The before image (pre-update value) is used by rollback to undo changes, while the after image (post-update value) is used by roll-forward to reapply committed updates.

Transactional Batch

A Cosmos DB SDK feature that processes multiple items within one logical partition atomically (all-or-nothing). Different in purpose from Bulk Support (non-atomic, high-throughput parallel ingest).

Transactional vs analytical workloads

OLTP handles many small reads/writes fast with consistency for operational systems; OLAP aggregates/analyzes large data for decisions. Data flows OLTP → (ETL) → OLAP.

Transactions and ACID properties

A transaction is a unit that treats a series of operations as a single whole; if it fails partway through, the entire transaction is undone (rolled back). The ACID properties — atomicity, consistency, isolation, and durability — are the four qualities a transaction must satisfy.

Transfer Appliance

An offline transfer service that ships large data on a physical device for ingestion into Cloud Storage; suits volumes where network transfer is impractical.

Transfer learning and data augmentation

Adapt a pretrained model on little data. Degree: tiny/near-domain = freeze as a feature extractor (final layer only), moderate = partial fine-tune of top layers, ample/distant-domain = full fine-tune at a low LR. Overfitting control: data augmentation (rotate/flip/crop), batch normalization, dropout, early stopping. Fine-tune pretrained models via SageMaker JumpStart.

Transit Gateway

A router that consolidates many VPCs and on-premises into a single hub. It avoids full-mesh VPC peering, simplifying large-scale connectivity with a hub-and-spoke model.

Transit Gateway appliance mode and centralized inspection

To inspect many VPCs’ traffic in one place (an inspection VPC), split TGW route tables to route through the inspection VPC. If forward and return traverse appliances in different AZs, asymmetric routing drops the return, so enable TGW appliance mode to pin a flow to the same-AZ appliance.

Transit Gateway attachment

The unit representing each thing connected to a Transit Gateway—a VPC, a VPN, a Direct Connect gateway, a Direct Connect transit VIF, or a peering to another TGW. Each attachment associates with exactly one TGW route table, which determines what it can communicate with.

Transit Gateway Connect

An attachment type connecting SD-WAN appliances or virtual routers to a Transit Gateway at high throughput via GRE tunnels + BGP.

Transit Gateway route table

A route table that controls reachability between the attachments connected to a Transit Gateway. Combining association (which route table an attachment resolves routes through) with propagation (whether another attachment's routes are auto-injected) implements segmentation between environments such as production and development.

Transit Gateway vs. VPC peering

Choosing a connectivity model. VPC peering is 1:1 and non-transitive (A-B and B-C don’t let A reach C), so full mesh explodes in management. Transit Gateway is hub-and-spoke, aggregating many VPCs/on-prem with route-table segmentation (for scale).

Translation API

A pretrained API that translates across languages, used for tasks like website localization.

Transmission media (UTP, coax, fiber)

Transmission media for wired networks. UTP (unshielded twisted pair) twists copper wire pairs to reduce noise and is the mainstay of LAN cabling (up to about 100 m); coaxial cable is an older design with a center conductor wrapped in braided shielding; fiber optic cable transmits light signals, is immune to electromagnetic interference, and is used for long-distance, high-speed links (laser-driven single-mode fiber for long distances, LED-driven multimode fiber for short-to-medium distances).

Transmission Rate

Transmission rate is a metric expressing the number of bits transmittable per unit time, denoted in bps (bits per second), representing the nominal theoretical capacity (bandwidth) of a link or interface. It is distinct from throughput, the actual effective data transfer rate, since transmission rate is a physical/data-link-layer nominal value unaffected by protocol overhead or congestion; it frequently appears in calculations involving transmission efficiency (transmission rate × efficiency = effective throughput).

Transmission Time

The time required to send data over a network, calculated by dividing the data volume by the line's transmission speed (bandwidth). Actual response time adds propagation delay and processing time, and the effective line speed must be evaluated by multiplying the theoretical value by transmission efficiency.

Transparent Data Encryption (TDE)

Encrypts an Azure SQL database at rest (files and backups) and is on by default. It needs no app changes (transparent) and decrypts on the server during processing, so DBAs and the server can handle plaintext. The protector can switch from the default service-managed key to a CMK (BYOK). TDE protects data at rest; TLS protects in transit.

Tree structure

A data structure that represents data as a parent-child hierarchy. It branches downward from a top element (the root) to lower elements (nodes and leaves), making it well suited to representing hierarchical data such as folder structures or organization charts.

Tree structures and binary search trees

A hierarchical data structure made up of nodes and edges. A binary search tree is organized so that a node's left subtree holds smaller values and its right subtree holds larger values, enabling search, insertion, and deletion in average O(log n) time.

Trial environment

A time-limited evaluation environment (auto-deleted after a set period); used to trial premium features temporarily.

Trigger

What starts a flow (e.g., email received, a time, a button press)—one per flow; actions follow the trigger.

Trigger

A mechanism that automatically invokes a specified function when an event such as INSERT/UPDATE/DELETE occurs. It can be scoped to row-level or statement-level and timed as BEFORE or AFTER the event, typically paired with a trigger function written in PL/pgSQL.

Trigger phrase

Example user utterances that start a topic; registering several lets similar phrasings match the right topic.

Triggers and user-defined functions (UDFs)

Server-side JavaScript. Triggers run with operations—pre (validate/enrich before write) and post (process after write)—specified per request. UDFs are custom compute callable inside a query but often bypass indexes, potentially raising RU.

Trunk-based development

A source-control strategy that integrates short-lived branches into main (the trunk) frequently, hiding unfinished work behind feature flags so it can coexist safely in production and avoiding long-lived merge conflicts. It pairs well with CI/CD and underpins continuous integration.

Trust policy

A special resource policy attached to an IAM role that defines who may assume it (who can call sts:AssumeRole). It is distinct from the identity-based policy that grants the role's own permissions—both must align for the role to actually be assumable.

Trust rules

Defines which external organizations (domains) sharing is allowed/restricted with, governing external sharing; domain-based, a different axis from content-based DLP.

Trusted launch

Boot-level VM protection providing secure boot (only signed bootloaders run), virtual TPM (vTPM), and integrity monitoring against rootkits and boot-level malware. Configured as the VM security type—a separate layer from at-rest disk encryption.

TTL (Time to Live)

Setting a default TTL on a Cosmos DB container auto-deletes old items from the transactional store (overridable per item), managing data lifetime. Separate from analytical-store retention.

TTP

A term for analyzing attacker behavior at three levels: tactics (the overall goal), techniques (the general method used to achieve it), and procedures (the specific implementation or steps). The MITRE ATT&CK knowledge base is essentially a catalog of TTPs.

Tuckman ladder (stages of team development)

A model describing team development through five stages: Forming, Storming, Norming, Performing, and Adjourning. It is important as the basis for the judgment that leadership style should be adapted to the team current stage.

Tunneling

A technique that encapsulates packets of one protocol inside packets of another to traverse dissimilar networks or unsupportive segments. It underlies IPv6-over-IPv4 mechanisms (e.g., 6to4) and VPNs (GRE, IPsec tunnel mode), letting intermediate devices forward traffic without inspecting the encapsulated payload.

Tuple and attribute

In the relational model, a tuple is one row of a table (a single record), and an attribute is one column (a single field). Discussions of relational algebra and normalization theory operate at the level of tuples and attributes.

Turnaround time and response time

Turnaround time is the total elapsed time from when a user submits a request until all results have been received, measuring submission to completion. Response time is the time from issuing a request until the first response begins to return, measuring perceived responsiveness. The architect uses response time as the primary metric for interactive systems and turnaround time for batch processing when designing and evaluating performance.

Twelve-Factor App

A set of principles for cloud-native apps: externalize config to env vars, keep processes stateless, treat logs as event streams, design for disposability, and keep dev/prod parity. A guide to scalable, portable applications.

Two-factor authentication (2FA)

Verifying identity with a second factor beyond a password; passkeys are recommended and orgs can require it.

Two-phase commit (2PC)

A protocol for atomically committing a distributed transaction spanning multiple databases. A coordinator first runs a prepare phase, asking all participants whether they can commit, then a commit phase instructing everyone to finalize once all agree. It is vulnerable to mid-protocol participant failures, and coordinator failure can cause blocking.

Two-phase locking

A locking protocol that guarantees serializability for concurrent transactions. A transaction proceeds through two phases: a growing phase, in which it only acquires locks, and a shrinking phase, in which it only releases them—once a lock is released, no new lock may be acquired. This discipline guarantees that the resulting schedule is equivalent to a serial execution.

Two's complement

A method computers use to represent negative numbers. The two's complement of a number is obtained by inverting all bits (one's complement) and adding 1. It allows addition and subtraction to be handled by the same circuit, which is why most CPUs adopt it.

Types of malware (virus, worm, trojan horse, spyware)

Common classifications of malware. A virus parasitizes other programs or files and spreads when its host is executed. A worm needs no host and self-replicates to propagate autonomously across networks. A trojan horse disguises itself as a harmless legitimate program to intrude and performs malicious actions internally without self-replicating. Spyware secretly collects information without the user noticing and sends it to an external party.

Types of monitoring data (full packet capture, session, transaction, metadata, alert)

Full packet capture stores everything including the payload — detailed but heavy. Session data (flow data such as NetFlow) records a flow-level summary (who talked to whom, when, how much, and on which ports). Transaction data is a record of application-layer exchanges themselves, such as HTTP requests or DNS queries. Metadata is attribute information about a communication rather than the communication itself. Alert data is the notification an IDS/IPS or similar tool generates as a detection result. Knowing which type to consult for a given purpose is the point.

UART (Universal Asynchronous Receiver/Transmitter)

An asynchronous serial communication method in which no clock signal is shared; each device uses its own independent clock and communicates based on a pre-agreed baud rate. Wiring is minimal — just TX and RX — but communication fails if both sides' baud rate settings do not match. It is widely used for debug consoles and simple point-to-point communication.

UDM and parsers

UDM (Unified Data Model) is the unified schema Google SecOps normalizes ingested logs into, enabling source-independent search/detection; parsers extract fields from raw logs into UDM (modify/extend as needed).

UDP

A lightweight, connectionless transport-layer protocol with no ordering guarantee or retransmission. Its low overhead makes it fast, so it's used for DNS lookups and video/audio streaming—cases that prefer low latency over occasional loss.

UEBA and threat intelligence

UEBA (user/entity behavior analytics) detects deviations from baseline, correlated with threat intelligence (IoCs, MITRE ATT&CK) to identify advanced attacks.

UEFI / BIOS

Firmware that runs right after power-on; it initializes hardware (POST self-test), selects and prioritizes the boot device, and loads the boot loader. UEFI is the successor to BIOS, supporting GPT disks and large capacities.

ULA and APIPA

A ULA (unique local address) is an IPv6 address in the fc00::/8 range that is defined in fc00::/7 (in practice the locally-assigned fd00::/8 range is what is used), not routed on the internet and scoped to an organization (the IPv6 counterpart of an IPv4 private address). APIPA is an IPv4 address in the 169.254.0.0/16 range that Windows and similar systems assign automatically when no DHCP server can be found, usable only within the local segment.

ulimit / TMOUT

ulimit caps resources for the shell and its children (-n open files, -u processes, -c core size). TMOUT is the idle seconds before auto-logout, set in a profile as a defense against unattended terminals.

UML (Unified Modeling Language)

A standardized modeling language for diagramming object-oriented system design and analysis results in a unified notation. It includes multiple diagram types for different purposes, such as class diagrams (static structure), use case diagrams (interaction between a system and its users), and sequence diagrams (time-ordered message exchange between objects).

Underfitting and bias–variance

Underfitting (high bias) is when both train and test accuracy are low, addressed by adding model complexity, more features, or more training. The bias–variance trade-off describes how increasing model complexity lowers bias but raises variance (overfitting risk); hyperparameter search hunts for the configuration that balances the two.

Underpinning contract (UC)

A contract with an external supplier or vendor that underpins, from the outsourced portion, the service levels promised to customers in the SLA. Whereas an OLA is an internal agreement, a UC is a legal contract with an external party. A service manager designs UC targets and penalties so that SLA targets can be met, monitors supplier performance, and manages the arrangement so external dependencies do not become a weak point in service levels.

UNDO/REDO logging recovery

The two operations used with the log during failure recovery: UNDO reverses changes made by transactions that never committed, and REDO reapplies changes that were committed but not yet flushed to disk. Recovery scans the log since the last checkpoint from both angles to restore a consistent state.

Unfair Competition Prevention Act (trade secrets)

A law prohibiting the wrongful acquisition, use, or disclosure of a "trade secret" — information that meets three requirements: it is managed as confidential (secrecy management), it is useful business information (usefulness), and it is not publicly known (non-public). It is the legal basis for remedies against an employee who takes a customer list or technical information and uses it at a new employer.

Unicast

The most common one-to-one communication mode, sending from a single source to a single destination. Ordinary client–server traffic and most API calls are designed around this mode.

Unified diff

A standard text format for expressing the difference between two files (or the same file before and after a change). Removed lines are prefixed with "-", added lines with "+", and each changed region is introduced by a hunk header starting with "@@". It is the format behind Git diffs and is widely used in code review and configuration-change review.

Uniform bucket-level access

A recommended Cloud Storage setting that manages permissions centrally via IAM at the bucket level instead of per-object ACLs—simpler and safer.

Unit testing and secret management

A unit test verifies the smallest unit of logic — a function or class — in isolation; in Python this typically means unittest or pytest, run automatically on every change as part of the CI/CD pipeline. Secret management is the practice of keeping secrets like API keys and passwords out of code as plaintext, externalizing them to environment variables or a vault (a dedicated secrets service) instead, to prevent them from accidentally being committed to a repository.

Universal design

A design philosophy that aims to make products and environments usable by as many people as possible, regardless of differences in age, disability, language, or culture — a broader scope than barrier-free design, which addresses specific groups of users.

Universal Print

A Microsoft cloud print platform that prints directly from session hosts via the cloud without an on-prem print server, meeting Azure Virtual Desktop printing requirements serverlessly.

Unmanaged solution

The editable, work-in-progress state of a solution in a development environment—components are unlocked and can even directly edit components owned by other solutions. Once development is done, it is converted to managed (chosen at export time) for distribution to test/production environments.

Unpivot

A Power Query operation turning wide columns into tall attribute/value pairs; many analyses prefer the tall shape. Pivot is the inverse.

Unstructured data

Data with no fixed schema, stored as files/objects. E.g., images, video, audio, documents.

Unsupervised learning

Finding structure in unlabeled data; e.g., clustering (grouping).

Updatable view and WITH CHECK OPTION

A view defined by a simple projection/selection from a single table can be written back as an update to the underlying table (an updatable view). Adding WITH CHECK OPTION rejects updates or inserts that would fall outside the view's defining condition, preserving consistency when accessed through the view.

Update rings (Intune)

A policy-based mechanism that codifies Windows Update for Business settings, staging update rollout timing (deferral days) and restart grace periods differently per device group (ring). Detecting problems in an early ring (IT/pilot group) before rolling out to broader rings limits the blast radius of a bad update.

Update types (feature updates / quality updates)

A classification of Windows updates by purpose. Feature updates are large, roughly annual releases that add new capabilities (equivalent to moving to a new OS version); quality updates are monthly releases (centered on Patch Tuesday, the second Tuesday) carrying security and bug fixes. Update rings let admins set separate deferral days for each type.

UpdateContext (context variable)

Sets a context variable scoped to a single screen; manages temporary state limited to that screen.

UpsertRequest

A message that updates-if-exists/creates-if-not in one operation, avoiding retrieve-then-branch. Distinct from CreateRequest/UpdateRequest.

upstream

The conventional remote name for the original (forked-from) repo; your fork is origin.

Usage patterns (adoption / unused features)

An analysis lens evaluating feature adoption, activity, and unused features to drive enablement/rollout and cost reviews.

Usage report

A report showing metered consumption by org/repo and trend, used for budgeting, chargeback, and cost-optimization decisions.

Use case diagram

A UML diagram that shows the functions a system provides to the outside (use cases) and the people or external systems that use them (actors). Actors are drawn as stick figures and use cases as ovals, connected by lines that make the system boundary explicit, with include and extend relationships adding detail. A system architect uses it early in requirements analysis to agree on the scope of functions from the user's viewpoint and to visualize that scope.

User and group management (useradd / usermod)

Commands to manage accounts: useradd creates (-m makes a home), usermod modifies (-aG adds groups—forgetting -a replaces them), userdel removes (-r deletes the home). Groups use groupadd/groupmod/groupdel. The new-home template is /etc/skel/, defaults are in /etc/default/useradd.

User data

A bootstrap script run at an EC2 instance's first boot to automate package installation and configuration; by default it runs once at launch.

User lifecycle and compromise response

Creating, suspending, and deleting user accounts and responding to compromise. Suspend / password reset / session revocation contain incidents quickly; bulk actions handle many users; account recovery guards against mistakes.

User-centered evaluation

Evaluating quality continuously using real-user feedback (👍/👎, free-text, implicit signals)—not just automatic metrics—combined with golden-dataset automatic evaluation to improve models/prompts by real-world satisfaction and task success.

User-defined function (Warehouse)

Functions in Fabric Warehouse that encapsulate reusable logic in T-SQL. In addition to inline table-valued functions (inline TVFs), scalar UDFs (returning a single value) have been supported since 2025 (in preview, not GA). A scalar UDF must be inlineable to be used in a SELECT statement (constructs like WHILE loops or nondeterministic calls prevent inlining). It lets a common calculation be maintained in one place; note the feature gap versus on-premises SQL Server or Synapse for multi-statement TVFs and other constructs.

User-defined route (UDR)

A manual route overriding system routes: define destination prefix → next hop (virtual appliance/gateway/internet/none) and associate the route table with a subnet.

USERELATIONSHIP (DAX)

A DAX function that temporarily activates an inactive relationship in the model, scoped to a single calculation. Used as a CALCULATE modifier, it lets you pick which of several relationships between two tables (e.g., order date vs. ship date) applies for a given expression.

UUID / label (blkid)

Robust ways to identify a filesystem: using UUID= or a label in /etc/fstab survives device-order changes (e.g., /dev/sdb becoming /dev/sdc). Inspect UUIDs with blkid.

UX and UI

UI (user interface) is the actual screen and operating method that forms the point of contact between a user and a product or system. UX (user experience) is the broader concept of the experience and satisfaction a user gains throughout the whole process of using a product or service.

V-Order

A Fabric write-optimization that reorders Parquet/Delta for reads, speeding Power BI (especially Direct Lake) and SQL reads.

VACUUM

A Delta maintenance command that deletes old unreferenced files no longer needed for time travel, reclaiming storage; mind the retention period.

VACUUM / ANALYZE

VACUUM reclaims dead tuples left by deletes and updates, preventing table bloat. VACUUM FULL physically rewrites the table under an exclusive lock and returns space to the OS (not generally recommended in normal operation). ANALYZE updates the statistics used by the query planner. The two serve different purposes, and autovacuum runs them automatically on a schedule.

VACUUM FREEZE and transaction ID wraparound

Because transaction IDs are a 32-bit circular counter, leaving them unaddressed lets them wrap around, potentially making old data invisible as if it were from the future. VACUUM FREEZE is the standard countermeasure, marking old rows as "frozen" (always visible)—since PostgreSQL 9.4 this is implemented via a frozen bit in the tuple header rather than rewriting the XID to FrozenXID. If ignored, autovacuum eventually kicks in with an emergency run, and if that still cannot keep up, the system reaches a stage where it refuses new writes.

vacuumdb

A command-line wrapper that runs VACUUM (and ANALYZE) from the shell. Options like -a (all databases), -z (also run ANALYZE), and -j (parallel jobs) make it convenient for automating maintenance via cron and similar schedulers.

Validating AI output

A required practice of checking Copilot output before adoption—via code review, testing, security scanning, and fact-checking—including validating generated tests themselves.

Validity check

Verifies whether a detected token is still live (active) via provider APIs and prioritizes alerting for high-confidence secrets—focusing attention rather than chasing revoked/dummy values.

Value chain

A framework that breaks a company's business activities into primary activities — such as inbound logistics, operations, outbound logistics, marketing and sales, and service — and support activities such as HR, procurement, and technology development, to analyze where value is added.

Variable groups and Key Vault integration

Variable groups bundle settings shared across pipelines, with secrets retrieved securely via Azure Key Vault integration; secure files handle certificates, etc.

Variance at completion (VAC)

The variance between the budget and the estimated final cost, computed as VAC = BAC minus EAC. A positive value forecasts completion under budget while a negative value forecasts a cost overrun, making it an important metric for predicting a project financial outcome before completion.

Vector data management for AI

Stores embedding vectors for similarity search. On Azure, choose among Cosmos DB (NoSQL vector search), PostgreSQL pgvector, and Azure AI Search vector indexes by use case.

Vector databases

Stores embedding vectors for nearest-neighbor search, used as the retrieval layer for RAG. On AWS, options include OpenSearch Service (k-NN), pgvector on Aurora/RDS, MemoryDB, and DocumentDB (Amazon Kendra is not a vector DB but a separate managed-search service).

Vector store

A store for embedding vectors with nearest-neighbor search. In RAG it retrieves relevant chunks, often configured with Azure AI Search as the index store.

Vectored interrupt

An interrupt scheme in which hardware branches directly to a dedicated handler routine registered in advance for each interrupt source, via an interrupt vector table. Compared with a polled scheme that identifies the source in a single handler, it avoids the overhead of source identification and responds faster, which is why it is used in real-time-critical embedded systems.

Velocity

In agile development, the average amount of work (such as story points) a team actually completes per sprint. It is calculated from past sprint results and used as the basis for estimating future sprint planning and release forecasts.

Vendor (outsourcing) management

The practice of confirming and managing, through contracts (NDAs, SLAs), pre-selection evaluation, and periodic audits, that an outsourcing partner maintains a security level equal to or better than the commissioning organization's own, when business operations or system development/operation are outsourced. It aims to prevent information leaks or supply chain attacks originating from the vendor.

Vendor lock-in

A state of heavy dependence on a specific vendor’s products/formats that makes migrating away difficult; mitigated by standards and data portability.

Veo

Google video-generation model that creates video from instructions such as text.

Verified creator

An action creator verified by GitHub; used in policies like "allow only GitHub-authored + verified-creator actions."

Version control system (VCS)

A system that records the history of file changes, enabling revert, tracing who/why, and collaboration.

Versioning and release cycle

PostgreSQL distinguishes major versions (new features, released roughly annually) from minor versions (bug and security fixes only). Under its support policy, each major version is supported for about five years from its initial release.

Vertex AI

A unified AI platform to build, train, deploy, and operate ML models end to end, including using foundation models.

Vertex AI Agent Builder

A Vertex AI means to build agents that act autonomously toward a goal, and search apps.

Vertex AI AutoML

A Vertex AI capability that auto-builds high-quality custom ML models from tabular, text, image, or video data with minimal code. It runs neural architecture search and hyperparameter tuning under the hood to produce a model balancing accuracy against training cost. For quick SQL-only analysis, BigQuery ML can be the simpler choice.

Vertex AI Experiments and TensorBoard

Tracking for experiment reproducibility: Vertex AI Experiments records/compares params/metrics/artifacts; Vertex AI TensorBoard visualizes learning curves. Complementary—use both.

Vertex AI Feature Store

Consolidates computed features for reuse across teams/models; uses the same features for training/serving to prevent duplicate computation and training/serving skew. Online serving for low-latency inference; offline for bulk training.

Vertex AI Model Monitoring (skew/drift)

Continuously evaluates production models and alerts on training/serving skew (training vs serving input distribution) and feature/prediction drift (change over time), triggering retraining on threshold breaches; use attribution change as a proxy when labels are delayed.

Vertex AI Model Registry

A repository that centrally tracks trained models' versions, lineage, evaluation metrics, and deployment status. Multiple versions are grouped under the same model name, making it easy to see at a glance which version is deployed to which endpoint. It anchors model governance and reproducibility.

Vertex AI Pipelines (Kubeflow/TFX)

A service that runs ML pipelines defined in Kubeflow Pipelines or TensorFlow Extended (TFX) managed and serverless; for general (incl. non-ML) workflow dependencies/scheduling use Airflow-based Cloud Composer.

Vertex AI public/private endpoints

Deployment targets for online inference: public endpoints for internet exposure, private endpoints (Private Service Connect) to stay in-VPC with low latency. Follow demand with Vertex AI Prediction autoscaling or containerized serving.

Vertex AI Studio

A Vertex AI capability to quickly prototype, compare, and test prompts before production.

Vertex AI Workbench

Google Cloud's managed JupyterLab-based ML development environment. It supports enterprise-grade security controls—VPC Service Controls, private Google access, least-privilege service accounts—for serious ML development, with native integration to BigQuery and Cloud Storage built in.

Vertex Explainable AI

A Vertex AI feature that quantifies how much each feature contributed to an individual prediction (feature attribution). It uses methods like sampled Shapley for tabular data and integrated gradients for image data. Used for regulatory explainability, debugging, and bias detection.

Vertex ML Metadata and lineage

Records pipeline artifacts/executions/lineage so you can trace "which data, code, parameters produced this model," enabling audit and root-cause analysis; hook with model/data versioning.

Vertical (functional) vs. horizontal (load) distribution

Vertical (functional) distribution assigns different layers or functions to separate machines, e.g., a presentation host apart from a database host, raising per-function independence. Horizontal (load) distribution replicates machines that perform the same function and uses a load balancer to spread requests, increasing throughput and availability. Combining both to design scalability is a typical architect judgment.

Vertical scaling (scale up)

Scaling by upgrading a single instance's specs (CPU, memory, etc.). It requires little application change and is simple, but is capped by instance-type limits, tends to be a single point of failure, and often requires downtime to apply. The counterpart choice to horizontal scaling.

VertiPaq (columnstore engine)

The columnar in-memory engine behind Import/Direct Lake models; compresses per column and accelerates aggregation.

vg* commands (volume group operations)

LVM commands for volume groups (VG): vgcreate builds a VG from PVs, vgextend adds PVs, vgreduce removes a PV, vgremove deletes the VG, and vgdisplay/vgs show VG information.

vi (vim)

The standard editor present on nearly all Linux systems. It starts in normal mode (keys are commands); enter insert mode with i/a/o and return with ESC. Move with hjkl, delete a line with dd, yank with yy, paste with p (via the yank buffer), search with / and ?. Save-quit ZZ/:wq, discard-quit :q!, reload :e!.

View

A definition of a record list for a table—which columns show, the sort order, and filter conditions; used in model-driven app list screens.

View (Warehouse)

An object that lets a saved SELECT statement in the warehouse be reused as if it were a table. Complex joins/aggregations are hidden behind the view, simplifying downstream reports and queries; a view stores no data itself and re-evaluates the underlying tables on each reference.

View and materialized view

A view is a named query definition that is recomputed from the underlying tables each time it is referenced and does not store its result. A materialized view differs in that it physically stores the query result and does not reflect changes to the underlying tables until explicitly refreshed with REFRESH.

virsh

A CLI to manage virtual machines via libvirt; virsh start / virsh shutdown start and stop VMs.

Virtual filesystems (/proc, /sys)

Information windows with no on-disk存在, generated in memory by the kernel: /proc exposes process/kernel state (e.g., /proc/cpuinfo) and /sys (sysfs) the device tree.

Virtual host

A mechanism for hosting multiple domains (sites) on a single web server. Apache or nginx separates configuration per domain, IP, or port so each responds as an independent site.

Virtual hub (Virtual WAN)

The managed hub at the core of Virtual WAN; hosts VPN/ExpressRoute/P2S gateways and connections, transiting spokes via hub routing.

Virtual machine (VM)

A virtual computer running on a hypervisor with its own independent guest OS (including a kernel); it can run a different OS from the host but boots slower and uses more resources.

Virtual machine image

An image file packaging an OS and applications in a pre-configured state. Virtual machines with identical configuration can be quickly cloned and started from it, supporting scale-out and machine reprovisioning.

Virtual machine scale sets (VMSS)

A set of identical VMs that autoscales with load (the performance axis; availability is via sets/zones).

Virtual memory and paging

A technique that lets programs larger than physical main memory be executed. A program is divided into fixed-size "pages," only the needed pages are loaded into main memory, and pages no longer needed are swapped out to secondary storage (paging).

Virtual network (VNet)

A private network in Azure; divided by subnets and connected to other VNets via peering.

Virtual network flow logs

Logs allowed/denied traffic to Storage (successor to NSG flow logs); visualized via Traffic Analytics to analyze traffic patterns and anomalies.

Virtual Private Cloud (VPC)

Google Cloud's software-defined network. A global resource that holds regional subnets in one network; routes, firewalls, and peering control traffic.

Virtual table (Dataverse)

A table that fetches and displays data from an external system on the fly via a data provider, without copying it into Dataverse. It behaves like a standard Dataverse table in model-driven apps and relationships, but since the real data stays external, it consumes no Dataverse storage.

Virtualization

Technology that uses software to create multiple virtual computers (virtual machines) on a single physical computer (server virtualization); storage, network, and desktop resources can likewise be virtualized. It allows hardware resources to be used efficiently and enables consolidation and flexible reconfiguration.

Visibility (Public/Private/Internal)

A repo audience: Public = anyone, Private = permitted users, Internal = within the same Enterprise.

Visibility Map

A bitmap recording, per heap page, whether every row on that page is visible to all transactions (and frozen). Because the index itself carries no visibility information, Index Only Scan consults this map: pages marked fully visible skip the heap entirely, while other pages fall back to the heap to check visibility. It is updated by VACUUM.

Visibility timeout

An SQS mechanism that hides an in-flight message from other consumers for a set time; if processing exceeds the visibility timeout the message reappears and can be processed twice, so tune it to processing time.

Vision API

A pretrained API to classify images and detect objects/text without ML expertise.

Visual calculations

A feature to compute with DAX over a visual’s displayed results (visible rows/columns), expressing running totals or shares within the visual without adding model measures.

Visual Query Editor

A no-code, drag-based Fabric query builder for selecting, filtering, and aggregating; generates SQL behind the scenes.

Visualization (visuals)

Showing data with chart elements (bar, line, pie, map, table, KPI) placed on a report to convey trends and comparisons at a glance.

Viva Engage (formerly Yammer)

An enterprise social app fostering org-wide community and connection. Part of the Microsoft Viva suite, used for leader connection and knowledge sharing.

VLAN (Virtual LAN)

A technique that logically divides switch ports into multiple broadcast domains without changing physical wiring. IEEE 802.1Q tagged VLAN adds a VLAN ID tag to frames so a single trunk link carries multiple VLANs distinctly. Communication between VLANs requires inter-VLAN routing by an L3 switch or router.

VLAN attachment

The logical link between a Cloud Interconnect and a VPC (Cloud Router); after creating the physical Interconnect, a VLAN attachment carries traffic to the actual VPC.

VLSM (Variable Length Subnet Mask)

A technique that divides a single address space into subnets with different mask lengths according to the host count each department or segment needs. Assigning right-sized blocks avoids address waste and unnecessary enlargement of the attack surface.

VM extensions and custom script

Mechanisms to add configuration/automation to a VM. The Custom Script Extension runs scripts at boot, and DSC and the Azure Monitor Agent are also deployed as extensions.

VMware Cloud on AWS

A service to run on-premises VMware vSphere environments natively on AWS—migrating/extending existing VMware workloads to the cloud without re-architecting.

VNet peering

Connects two VNets over the Microsoft backbone with low latency; non-transitive by default (A-B-C does not give A↔C), so hub transit needs UDRs or gateway transit.

VNF (Virtualized Network Function)

A network function such as a router, firewall, or load balancer that was traditionally implemented in dedicated hardware, reimplemented as software running in a virtual machine or container on general-purpose servers. VNFs run atop an NFV infrastructure (NFVI), enabling rapid deployment, elastic scaling, and flexible hardware refresh.

Voicemail policies

A policy controlling voicemail behavior—enabling/disabling voicemail, the forwarding email address, default or custom greeting messages, and enabling transcription. It scopes narrower than calling policies (which govern calling features broadly), covering voicemail only.

Volatile data

Data that disappears when power is lost or time passes — CPU registers, cache, running processes, network connection state, and the contents of memory. In a forensic investigation, this fleeting data must be collected before durable data on disk, following the order of volatility.

VPC endpoint

The entry point that privately connects a VPC to AWS services; interface endpoints create an ENI (via PrivateLink, for many services) and gateway endpoints serve S3/DynamoDB (via route table, free).

VPC endpoint implementation (private DNS / endpoint policy)

Enabling private DNS on an interface endpoint resolves the service’s normal name to the ENI’s private IP, switching to the private path with no code change. An endpoint policy (resource-based IAM) limits which APIs/resources are allowed through the endpoint and, combined with an S3 bucket policy aws:sourceVpce condition, can restrict access to a specific endpoint only. A gateway VPC endpoint is for S3/DynamoDB only—free, via the route table.

VPC endpoint types and private DNS

Gateway type (S3/DynamoDB only, via route table, free) and interface type (PrivateLink, ENI + private IP, many services, hourly cost). Enabling private DNS resolves the public service name through the endpoint transparently.

VPC firewall rules

Stateful rules that allow/deny traffic in/out of a VPC, evaluated by direction, priority, target (tags/service accounts), and source; hierarchical firewall policies exist at the org level.

VPC flow log fields and destinations

Flow logs record source/destination IP, ports, protocol, bytes, and ACCEPT/REJECT, etc. Destinations are CloudWatch Logs, S3, or Data Firehose. Enabled per ENI/subnet/VPC for investigating rejected traffic and analyzing flows.

VPC Network Peering

Directly connecting two VPC networks so they can communicate with each other.

VPC peering

A one-to-one direct connection between two VPCs. It is non-transitive, so connecting many VPCs becomes a hard-to-manage full mesh—use Transit Gateway at scale.

VPC Service Controls

A mechanism that prevents data exfiltration to managed services (e.g., BigQuery, Cloud Storage) via a service perimeter; a layer of control separate from IAM grants.

VPC sharing

A mechanism using AWS Resource Access Manager (RAM) to share one VPC's subnets across multiple accounts in an organization. Participant accounts can create resources in that subnet, centralizing network management with the owner account while still keeping account-level separation.

VPC-native clusters and alias IPs

A GKE networking model that allocates alias-IP secondary ranges to Pods and Services; scale ceilings are set by the allocated IP space, so reserve ranges generously at design time.

VPC/subnet quotas

The limits governing VPC network design—such as VPCs per Region and subnets per VPC—which can be checked and increase-requested via Service Quotas. By contrast, the subnet CIDR size range (/16 to /28) is a fixed architectural specification of VPC/subnets, not a Service-Quotas-adjustable value. A subnet's own CIDR block cannot be changed after creation, but a VPC's address space can be expanded by adding secondary CIDR blocks.

VPN (virtual private network)

A technology that builds an encrypted virtual private line over a public network, securely connecting sites or remote workers to an internal network. Tunneling and encryption prevent eavesdropping and tampering.

VPN Gateway

Connects on-premises over an encrypted tunnel across the internet.

VPN gateway SKU and redundancy

The SKU determining a VPN gateway’s performance/bandwidth/tunnel count; for availability use active/active or zone-redundant configurations.

VR and AR (virtual/augmented reality)

VR (virtual reality) immerses the user in a computer-generated virtual space, providing an experience that substitutes for reality. AR (augmented reality) overlays computer-generated information onto the real-world scene or video; the key distinction is that VR replaces reality whereas AR adds information to it.

VRF (Virtual Routing and Forwarding)

A virtualization technique that gives a single router or switch multiple independent virtual routing tables and FIBs. Because routes in different VRFs never mix, even overlapping IP address ranges can coexist, which is used to keep routing separate per tenant or per service. Communicating between VRFs requires route leaking or an external connection point.

VRIO analysis

A framework for diagnosing whether a firm's resources can be a source of sustained competitive advantage, by asking four questions: Value, Rarity, Imitability, and Organization. Strategists apply it to resources and capabilities identified through value-chain or core-competence analysis, judging that only resources satisfying all four conditions yield sustained advantage, in order to prioritize where to invest. A resource can be valuable, rare, and hard to imitate yet still fail to deliver advantage if the Organization condition is not met.

VRRP (gateway redundancy)

A protocol that groups multiple physical routers into one virtual router sharing a common virtual IP and virtual MAC address. Setting the virtual IP as the clients' default gateway lets a backup automatically take over the virtual IP/MAC if the master fails, eliminating the gateway single point of failure without changing client settings. HSRP is a similar protocol.

Vulnerability assessment

A service or activity in which tools or specialists inspect web applications, network devices, or servers for known vulnerabilities. Its purpose differs from penetration testing — which tries to actually break in — in that vulnerability assessment aims to exhaustively list known weaknesses.

Vulnerability management

The ongoing process of continually identifying and assessing the vulnerabilities present in an organization's systems, then prioritizing and remediating or mitigating them by severity. It cycles through scanning to identify issues, scoring them (e.g., with CVSS), applying patches or hardening, and reverifying.

VXLAN

An overlay tunneling technique that encapsulates L2 frames in UDP/IP over an L3 network. Its 24-bit segment identifier (VNI) allows about 16.77 million segments, breaking the 4094-segment limit of IEEE 802.1Q VLAN IDs (12 bits). VTEPs perform (de)encapsulation; it is used in large multi-tenant data centers.

WAF (Web Application Firewall)

A defense appliance or service that inspects the contents of HTTP/HTTPS traffic to detect and block attacks aimed at the web application layer, such as SQL injection and cross-site scripting (XSS). Unlike an ordinary firewall that filters by destination port or IP, a WAF examines the actual request content (parameters, etc.) of the application to make its decisions.

WAF Bot Control

An AWS Managed Rules rule group that identifies and controls known good bots (e.g., search crawlers) and bad bots (e.g., scrapers, credential-stuffing tools). It is recommended to deploy first in count mode to assess impact before blocking.

WAF logging

A feature that sends details of requests WAF inspected—matched rule, action taken, headers, etc.—to CloudWatch Logs, S3, or Kinesis Data Firehose. Used to investigate false positives and tune rules.

WAF policy and detection/prevention modes

A Web Application Firewall config associated with Application Gateway or Front Door; choose detection mode (log only) or prevention mode (block), using OWASP rule sets to stop common attacks.

WAF rules (managed/rate-based)

AWS WAF evaluates rules in a Web ACL: AWS managed rule groups (common threats, OWASP, bots), rate-based rules (limit IPs exceeding a threshold), and custom rules.

Wait statistics

Metrics showing what sessions wait on (I/O, locks, CPU, etc.). They are the starting point for classifying bottlenecks.

WAL (write-ahead log)

A log that records changes before they are written to the actual data files. It underpins crash recovery and, combined with WAL archiving, enables PITR.

WAL and checkpoint parameters (fsync/checkpoint_timeout/max_wal_size/wal_keep_size/checkpoint_completion_target)

Performance parameters around WAL and checkpoints. fsync determines whether writes are guaranteed to reach disk (off risks data loss on crash). checkpoint_timeout sets the maximum interval between automatic checkpoints. max_wal_size is the target upper bound on WAL growth between checkpoints. wal_keep_size is the minimum amount of WAL retained for standbys. checkpoint_completion_target is the target fraction of the checkpoint interval over which checkpoint writes are spread.

WAL archiving (archive_command)

A mechanism that copies WAL segment files to a separate storage location before they are recycled, preserving them for later use. The archive_command setting in postgresql.conf specifies the shell command run to archive each WAL segment.

wal_level

A parameter controlling how much information is written to WAL. minimal keeps WAL minimal and supports neither replication nor WAL archiving (PITR/hot standby); replica (the default, consolidating the old archive/hot_standby levels) includes what streaming replication and archiving need; logical adds further information (such as pre-change row data) required by logical replication.

walreceiver

The process on the standby that receives streaming replication data. It connects to the primary's walsender, writes the incoming WAL to local WAL, and hands it off for apply. If the connection drops, it attempts automatic reconnection depending on configuration.

walsender

The backend process on the primary that sends streaming replication data. One process is started per connected standby (or client such as pg_receivewal) and continuously ships WAL; the number of concurrent connections is capped by max_wal_senders.

WAN services (leased line, wide-area Ethernet)

Wide-area network services connecting sites. A leased line is occupied by one company over a specific span, physically isolated from others (high quality, high cost). Wide-area Ethernet and IP-VPN share a carrier network with logical isolation (more cost-effective). Choose per requirements (isolation, bandwidth guarantee, cost).

Warehouse (Fabric)

A Fabric DW item supporting full T-SQL (read-write, multi-table transactions); data is stored as Delta in OneLake.

Warm pool

A mechanism that keeps pre-initialized instances (stopped or running) on standby in a separate pool ahead of an Auto Scaling group's scale-out. It cuts startup time far below launching from scratch during a demand spike, especially valuable for apps with heavy boot processes; the standby state (stopped vs. running) lets you trade off cost against responsiveness.

Warnier method

A design technique that derives program structure from the input data structure, from a set-theoretic viewpoint. It expresses hierarchically with brackets how many times, when, and where data appears as nested repetitions, and builds the program top-down by combining the three control constructs of sequence, selection, and iteration. It contrasts with the Jackson method, which handles the correspondence between both input and output data structures. A system architect uses it to design processing driven by data structure.

Watch

Subscribes to a repository update notifications; distinct from Star.

Watchdog timer (WDT)

A hardware timer that automatically resets the system if software does not periodically restart (kick) it within a set interval. It detects runaway conditions such as infinite loops or deadlocks and forces automatic recovery, making it an essential safety mechanism in reliable embedded system design.

Waterfall model

A development approach that proceeds through phases — requirements definition, design, implementation, testing — in sequence, on the premise that, in principle, work does not return to a previous phase. It is easy to plan but not well suited to mid-project requirement changes.

Watermark (incremental marker)

A marker value (last-modified timestamp or sequence) tracking how far data was loaded; the next run pulls only rows newer than it.

WBS (Work Breakdown Structure)

A diagram that hierarchically decomposes a project's deliverables and work into manageably sized tasks. It forms the basis for assigning owners, effort, and schedule, and for tracking progress.

Wear leveling

A technique that spreads write operations evenly across all blocks of flash memory to prevent any single block from wearing out from concentrated writes, since flash has a finite erase/write cycle limit. It is an essential design element for extending storage lifetime in embedded applications with frequent rewrites, such as logging or firmware updates.

Web Application Firewall (Azure WAF)

Runs on Application Gateway (regional) or Front Door (global edge) to block L7 (application-layer) attacks like SQL injection and XSS. Combines OWASP managed rule sets with custom rules (geo-block, rate limiting). Roll out in Detection mode to check false positives, then switch to Prevention. NSG/Firewall operate at L3/L4; WAF is L7.

Web role

A role assigned to Power Pages visitors (anonymous/authenticated), tied to table permissions to decide who can see or submit what.

Web server

A server that accepts client requests over HTTP/HTTPS, returning static content or forwarding dynamic requests to an application server. Apache and nginx are common examples.

WebAuthn (passwordless authentication)

A W3C-standardized web authentication API for passwordless login based on public-key cryptography, part of FIDO2. An authenticator (biometric sensor or security key) holds the private key and only the public key is registered with the server, making it resistant to phishing and password leakage.

Webhook

Sends HTTP notifications to an external URL when repo/org events occur, used to automate CI integrations, SIEM, ticket creation, etc.

Webhook (Dataverse)

A destination that POSTs Dataverse events to any HTTP endpoint in real time, registered in the Plug-in Registration Tool. Choose vs Service Bus/Event Hub.

Webinar

An online event format that collects attendee information via a registration form and tracks attendance. It is presenter-centric—attendees are primarily viewers, with only limited interaction available through Q&A and chat—which distinguishes it from a regular Teams meeting where all participants have symmetric rights. Post-event reports on registrants/attendees are available. Scales up to roughly a few thousand attendees; suited to marketing or training scenarios that are presentation-driven and need attendance tracking.

Well-known ports

Default port numbers assigned to major services: 22 SSH, 25 SMTP, 53 DNS, 80 HTTP, 123 NTP, 443 HTTPS.

White-box testing

A testing technique that focuses on a program's internal structure (logic), verifying that every branch and path executes as intended, using coverage criteria such as statement coverage and branch coverage.

Wi-Fi 6 (IEEE 802.11ax)

The IEEE 802.11ax wireless LAN standard. Using OFDMA (Orthogonal Frequency-Division Multiple Access), it divides one channel into resource units to serve multiple devices simultaneously, greatly improving effective throughput in dense multi-device environments. Wi-Fi 6E extends it to the 6 GHz band.

Wi-Fi and IEEE 802.11

Wi-Fi is the Wi-Fi Alliance's interoperability-certification brand for wireless LAN equipment, built on the IEEE 802.11 family of standards. IEEE 802.11 includes variants such as b/g/n/ac/ax/be, which use the 2.4 GHz, 5 GHz, and 6 GHz bands in different combinations.

Wi-Fi Frequency Bands (2.4/5/6 GHz)

The 2.4 GHz band penetrates obstacles well and reaches farther but suffers from interference (e.g., microwave ovens) and few available channels. The 5 GHz band offers more channels and higher speed at shorter range. The 6 GHz band (Wi-Fi 6E/7) adds a wide contiguous spectrum largely free of legacy interference, providing many additional high-speed channels.

Wiki and repository insights

A Wiki manages long-form project docs and the README shows an overview. Insights visualize repository health—contributions, traffic, and the dependency graph.

Wildcard mask

A bit mask used in ACLs and OSPF network statements to specify a matching address range. Its bit meaning is inverted from a subnet mask: a 0 bit means the corresponding address bit must match, while a 1 bit means don't care. It is typically the bitwise inverse of the subnet mask.

Wildcard permission

Using "*" in a policy's Action or Resource (e.g., s3:*), which grants broader operations or resources than intended. This is a classic least-privilege violation, and IAM Access Analyzer policy validation or Access Advisor is used to detect and fix the excess.

Wildcards (globbing)

Shell expansion of filenames by pattern: * matches any run of characters, ? exactly one, [a-c] a set/range. Note the * differs in meaning from a regex *.

Window functions

A SQL feature that computes aggregates or ranks per row without collapsing rows the way GROUP BY does, specified via an OVER clause with PARTITION BY/ORDER BY. In execution plans, a preceding Sort based on PARTITION BY/ORDER BY is often inserted to support the window function.

Windowing and late data (streaming)

In streaming, design windowing (time-based aggregation) and late-arriving data handling with watermarks and allowed lateness; batch processes accumulated data together.

Windowing functions (streaming)

Aggregates a continuous stream over time windows: tumbling (non-overlapping), hopping (overlapping), sliding (event-driven), etc.

Windows 365 (Cloud PC)

Streams a cloud PC (desktop) to any device so you get the same environment anywhere.

Windows Autopatch

A managed update service where Microsoft takes over update-ring management and rollout monitoring for Windows, Microsoft 365 Apps, Microsoft Edge, and Teams. Devices are automatically sorted into four default deployment rings (Test/First/Fast/Broad), and Microsoft pauses/investigates on issues—aimed at reducing IT's update-management workload.

Windows Autopilot

Reuses existing hardware and automates Microsoft Entra join + Intune enrollment + configuration via OOBE (replaces traditional imaging). Modes: user-driven (user signs in to self-configure), pre-provisioning (IT preps in advance), self-deploying (no interaction, for kiosks).

Windows Defender and host-based firewalls

Windows Defender (now renamed Microsoft Defender Antivirus) is the malware-protection and threat-detection software built into Windows by default. A host-based firewall is a firewall installed on an individual device (host) rather than at the network perimeter, allowing or denying traffic for that device alone (e.g., Windows Firewall).

Windows Event Forwarding (WEF)

Forwards events from many Windows servers to a collector (WEC) for aggregation, then ingests into Sentinel via AMA—aggregating by scale instead of an agent on each server.

Windows Hello for Business

Enables passwordless authentication using biometrics (face/fingerprint) or a PIN, binding credentials to the device for phishing resistance.

Windows LAPS (Local Administrator Password Solution)

Auto-rotates/stores a unique local administrator password per device, preventing lateral movement from password reuse. A different layer from PIM, which elevates Entra/Azure role privileges.

Wireless LAN

A technology that connects devices to a network wirelessly using radio waves (WLAN), based on the IEEE 802.11 family (b/g/n/ac/ax/be; 11n=Wi-Fi 4, 11ac=Wi-Fi 5, 11ax=Wi-Fi 6, the 6 GHz extension=Wi-Fi 6E, 11be=Wi-Fi 7). It supports infrastructure mode via access points and ad-hoc mode for direct device-to-device links, with WPA2/WPA3 for encryption. "Wi-Fi" is the Wi-Fi Alliance interoperability-certification brand, often used loosely for wireless LAN but not strictly synonymous.

Wireless LAN roaming

A mechanism by which a wireless client, while moving, switches its connection from the current access point (whose signal has weakened) to another AP with a stronger signal without dropping the session. It requires configuring the same SSID and authentication method across the APs so the client sees them as one network.

Wireless LAN security (rogue AP countermeasures)

Because anyone within radio range can attempt to intercept traffic or connect to a wireless LAN, it is protected with WPA2/WPA3 encryption and authentication, careful SSID management, and MAC address filtering. A particular threat is a rogue access point masquerading as a legitimate one — an evil twin — that lures users into connecting so their traffic can be eavesdropped on or tampered with; users should verify the certificate and authenticity of the SSID they connect to, while organizations use wireless intrusion detection/prevention (WIDS/WIPS) to detect and remove unauthorized APs.

Wireshark and packet capture

An open-source packet analyzer that captures and inspects packets flowing on a network. Captures can be saved in .pcap format and inspected in detail down to each layer's headers and payload, making it useful for troubleshooting communication problems and learning protocols.

WLC (Wireless LAN Controller)

A device that centrally manages multiple lightweight APs. By consolidating configuration and control of SSIDs, radio channels, transmit power, and roaming into the WLC, it automates and centralizes work that would otherwise be configured on each AP individually.

Work package

The lowest level of the WBS, a unit of work small enough that cost and schedule can be estimated and managed without further decomposition. Decomposing to a granularity where owner, duration, and cost can be individually assigned is what makes schedule and cost control feasible.

Workaround

A temporary means of restoring or maintaining service before a permanent fix that removes the root cause is completed. It is applied to reduce an incident's impact and keep the business running, and effective workarounds are recorded in the KEDB for reuse.

Worker Dispatching Act

A law establishing the rules under which a dispatching agency sends workers to a client company. The client company gives work instructions, but the employment contract remains with the dispatching agency — the key distinction from a contract-for-work arrangement.

Workflow

An automation process defined as a YAML file under .github/workflows/; declares triggers in on: and runs one or more jobs.

Workflow automation (Defender for Cloud)

Triggers Logic Apps on security alerts or recommendations to automate responses like notifications, ticketing, and remediation.

Workflow commands

Special output commands to interact with the runner—log annotations (::notice::/::warning::/::error::), secret masking (::add-mask::), log folding (::group::).

workflow_call (reusable workflow)

A trigger declaration that lets other workflows call it via uses:; callers pass with: inputs and secrets: (inherit allowed) and can read outputs.

workflow_dispatch

A manual trigger from UI/API/CLI; define inputs with type/required/default/options to accept parameters at start.

Workflows

Serverless orchestration for lightweight cross-service step chaining (simple workflows); heavy dependencies use Cloud Composer.

Workforce Identity Federation

Federates human user identities managed in an external IdP (Okta/Azure AD, etc.) into Google Cloud access without creating Google accounts; do not confuse with Workload Identity Federation (for workloads).

Workload identity federation

A general-purpose mechanism where a cloud provider validates an OIDC (or similar) token issued by an external identity provider via a configured trust relationship, then exchanges it for short-lived credentials—granting access without any long-lived secret or password. Azure DevOps service connections, GitHub Actions, GCP, and AWS's OIDC federation all implement equivalent versions of this pattern. In Azure specifically, the exchange yields a token for a role-assigned service principal or managed identity, which is mechanically different from AWS's 'assume role' terminology.

Workload Identity Federation (GCP)

A mechanism that trusts an external identity provider outside Google Cloud—AWS, Azure, on-prem, or CI/CD like GitHub Actions—and exchanges its issued tokens for temporary Google Cloud credentials. Used for external system integrations where you want to avoid downloading and distributing service-account keys.

Workspace (Fabric)

The unit that groups items (lakehouse, notebook, pipeline) for collaboration and access control; assigned to a capacity.

Workspace (Power BI)

A place in the Power BI service where teams co-manage and distribute reports, dashboards, and datasets, sharing via assigned access.

Workspace editions

Subscription tiers such as Business (Starter/Standard/Plus) and Enterprise. The advanced security/compliance features available (DLP, Vault, context-aware access, etc.) depend on the edition.

Workspace roles (Fabric)

The workspace permission hierarchy Admin > Member > Contributor > Viewer; assign by least privilege and combine with data-level permissions.

WPA (Wi-Fi Protected Access)

A wireless LAN encryption/authentication standard. The original Wi-Fi Protected Access (WPA), introduced to address WEP's weaknesses, uses TKIP but is now deprecated in favor of the stronger WPA2 and WPA3.

WPA2-PSK and WPA2-Enterprise

WPA2 offers two authentication modes. WPA2-PSK (WPA2-Personal) authenticates every device with one shared passphrase, a simple scheme suited to homes and small sites; WPA2-Enterprise authenticates each device or user individually via 802.1X/RADIUS, suited to large organizations that need per-user access control.

WPA3 and SAE

SAE (Simultaneous Authentication of Equals, aka Dragonfly), the key-establishment method adopted by the wireless LAN security standard WPA3. It resolves the offline-dictionary-attack weakness of WPA2-PSK's four-way handshake with a scheme that cannot be brute-force-verified from mere traffic interception.

Write Accelerator

A feature that lowers write latency for specific disks on M-series VMs, used mainly for the SAP HANA transaction-log disk. Note it is not for read cache or data disks.

Write DML (INSERT/UPDATE/DELETE)

DML statements that add, modify, and remove rows. INSERT adds new rows; UPDATE, typically written as UPDATE ... WHERE, changes column values of existing rows matching a condition; DELETE removes rows matching a condition. Inside triggers, the row before and after the change can be referenced as OLD/NEW.

Write-ahead logging (WAL)

The principle that a change's log record must be written and durable before the corresponding data page is actually modified. It allows changes to be reconstructed from the log after a crash and underpins durability (the D in ACID).

Write-through / write-back

Cache write policies. Write-through writes to both the cache and main memory simultaneously, preserving consistency at the cost of higher bus traffic. Write-back writes only to the cache and defers the update to main memory, giving higher speed but risking data loss if power is lost before the write-back occurs. Embedded designers choose between them based on the trade-off between real-time performance and data integrity.

X management layers (display manager/window manager/desktop environment)

The three X management layers: the display manager (e.g., GDM) provides the graphical login, the window manager handles window frames/movement/stacking, and the desktop environment (GNOME/KDE) bundles the full desktop. startx launches X manually without a display manager.

X Window System (X server / X client)

The server/client foundation of the Linux GUI: the X server runs where the display/input are and provides drawing and input, while X clients are the applications. Where an app runs and where it displays can differ.

X-Ray sampling and subsegments

Sampling traces only a fraction of requests (rate controlled by rules) to limit overhead and cost. Segments/subsegments are the service spans/internal work (e.g., DB calls) within a trace; annotations add filterable metadata.

X.509 certificate, cipher suite, and key exchange

X.509 is the standard format for a digital certificate, containing the issuer, validity period, public key, and signature, among other fields. A cipher suite is the named bundle of algorithms a TLS session uses: through TLS 1.2 it covered the key-exchange method, signature method, symmetric cipher, and hash function, but in TLS 1.3 a cipher suite denotes only the symmetric cipher plus hash, while key exchange (ECDHE by default, providing forward secrecy) and signature are negotiated separately. Key exchange is the procedure (such as Diffie-Hellman/ECDHE) by which two parties establish a shared symmetric key without a third party learning it.

xargs / tee

xargs turns incoming text into arguments for the next command (find … | xargs rm)—a bridge to commands that take arguments, not stdin. tee duplicates a stream to both the screen and a file.

XML

A markup language that expresses hierarchical structure with tags. It is the message format NETCONF uses, and device configuration is sometimes represented as an XML document too. It is more verbose than JSON, but differs in supporting strict validation via a schema (XSD) and inline comments.

XMLA endpoint

A connection point to connect, deploy, and manage semantic models from external tools (Tabular Editor); used to operate large models.

XP (Extreme Programming)

A leading agile development method that emphasizes iterative development by small teams and responsiveness to change. It is characterized by practices such as pair programming, test-driven development (TDD), refactoring, continuous integration, and small releases. Whereas Scrum centers on a framework for running the project, XP places emphasis on technical development practices.

YAML

A human-friendly text format that expresses hierarchy through indentation. Favored for CloudFormation and other IaC tools and CI/CD pipeline config files, and interconvertible with JSON representing the same data.

YAML anchors / aliases

A YAML feature to reuse repeated fragments within one file (anchor &, alias *, merge key <<); expanded by the parser before evaluation. Not for cross-file sharing (use reusable workflows for that).

YAML pipelines and templates

Defines pipelines as code (YAML) with stages, jobs, and steps. Templates reuse common logic, and multi-stage pipelines combine CI and CD to multiple environments in one definition.

YARA-L detection rules

The rule language in Google SecOps for detecting suspicious behavior; combine with reference lists (lists of known values) and entity/context data to raise accuracy.

yum / dnf (RHEL family)

Repository-based package management on RHEL/CentOS (successor dnf): yum update upgrades packages (index auto-refreshes), plus install/remove/search/info. provides reverse-looks-up the package for a file; yumdownloader only downloads. Repositories are .repo files in /etc/yum.repos.d/, with global settings in /etc/yum.conf.

Z-Order (data skipping)

Co-locates data by frequently filtered columns so irrelevant files can be skipped (data skipping).

Zero Trust

The principle of "never trust, always verify"; verify identity, device, and context on every access, even inside.

Zero trust (concept)

A security philosophy that does not assume access is safe simply because it originates inside the corporate network, and instead verifies every access attempt. It is considered well suited to environments with more external access and cloud use.

Zone file

A text file listing the resource records (SOA, NS, A, MX, etc.) belonging to a DNS zone. In BIND, named serves domain name-resolution information based on this file.

Zone redundancy (Azure SQL)

An HA configuration spreading replicas across availability zones within a region to tolerate datacenter failure. Available on many service tiers.

Zone transfer

The mechanism by which a primary (master) DNS server replicates zone-file contents to a secondary (slave) DNS server, keeping the secondary up to date with the latest zone information.

.github/workflows

The default directory holding workflow YAML in a repository; YAML placed here is recognized as Actions.

.gitignore

A file listing files/patterns to exclude from tracking (build outputs, dependencies, secrets).

/dev/null

A special device that discards everything written to it; used to throw away unwanted output (2> /dev/null hides errors).

$GITHUB_ENV

A special file to pass a runtime-computed value as an env var to later steps; append like echo "KEY=value" >> "$GITHUB_ENV".

$GITHUB_OUTPUT

A special file to set a step output; write echo "name=value" >> "$GITHUB_OUTPUT" and read within the job via steps.<id>.outputs.<name>. For passing short values.

$GITHUB_STEP_SUMMARY

A special file where appended Markdown renders as a rich job summary (test tables, coverage, links) on the run page.