Cloud Security Operations · Topic 3 of 6
Availability, Monitoring and Backup Operations
CCSP cloud operations: clustered host availability, guest OS availability, performance, capacity and hardware monitoring, backups and the management plane.
- 5 min
- DRS places and balances workloads; dynamic optimization rebalances continuously.
- HA restarts virtual machines after host failure; maintenance mode empties a host for planned work.
- Guest availability needs redundant instances, health checks and load balancing.
What it is
Availability is part of security. Operating cloud infrastructure means keeping clustered hosts and guest systems running, watching performance, capacity and hardware health, backing up and restoring hosts and guests, and running the management plane's scheduling, orchestration and maintenance safely.
Most of this is the provider's job for the underlying platform, and the customer's job for its own workloads in IaaS.
How it works
Availability of clustered hosts
| Feature | What it does |
|---|---|
| Distributed resource scheduling | Places and moves virtual machines across a cluster to balance load and respect rules |
| Dynamic optimization | Continuously rebalances resources and can power hosts on or off as demand changes |
| Storage clusters | Groups of storage nodes presented as one pool, replicating data so a node failure loses nothing |
| Maintenance mode | Moves workloads off a host so it can be patched or repaired without downtime |
| High availability (HA) | Restarts virtual machines on surviving hosts when a host fails |
Storage clusters can be tightly coupled (nodes share a backplane and act as one system) or loosely coupled (independent nodes linked over the network, scaling more easily). Affinity and anti-affinity rules keep related machines together or deliberately apart, for example two domain controllers on different hosts.
Availability of guest OS
Host HA restarts a failed virtual machine but does not protect against a crashed application or a corrupt OS. Guest availability needs:
- Redundant instances behind a load balancer, across availability zones.
- Health checks that replace unhealthy instances automatically.
- Clustering at the application or database level where needed.
- Tested images so a replacement starts in a known good state.
Performance and capacity monitoring
| Area | Example metrics |
|---|---|
| Network | Throughput, latency, packet loss, dropped connections |
| Compute | CPU utilization, memory use, swap activity |
| Storage | IOPS, latency, queue depth, free space |
| Response time | Time for the application to answer user requests |
Thresholds trigger alerts and, where configured, automatic scaling. Trends feed capacity planning. A sudden change in metrics can also be a security signal, such as CPU spikes from crypto mining malware or outbound traffic spikes from data exfiltration.
Hardware monitoring
Providers and private cloud operators monitor disk health (error counts and predictive failure warnings), CPU temperature and errors, fan speed, power supply status and ambient temperature. Out of band management controllers report these even when the OS is down. Predicted failures trigger maintenance mode before the hardware fails.
In public cloud, customers do not see hardware metrics; the provider may notify them of scheduled maintenance or degraded hosts.
Host and guest OS backup and restore
| Level | What is backed up | Notes |
|---|---|---|
| Host configuration | Hypervisor settings, cluster and network configuration | Lets a failed host be rebuilt quickly |
| Guest snapshot | Point in time image of a virtual machine's disks | Fast rollback; not a long-term backup on its own |
| Guest file or application backup | Files, databases with application consistency | Needed for consistent database recovery |
Good practice:
- Encrypt backups and protect the keys separately.
- Store copies in a different account, region or provider; use immutability against ransomware.
- Follow a rule such as three copies, on two types of media, one off-site.
- Test restores regularly; an untested backup is an assumption.
- Remember snapshots hold the same sensitive data as the original and need the same access controls.
Management plane operations
| Function | What it involves | Security point |
|---|---|---|
| Scheduling | Deciding when and where workloads run and when jobs execute | Prevent unauthorized placement on untrusted hosts |
| Orchestration | Automated provisioning and coordination of resources | Templates and pipelines are privileged code; review and protect them |
| Maintenance | Patching and upgrades of hosts and management tools | Use maintenance mode and change management; notify affected tenants |
A worked example
A private cloud cluster suffers a host failure during peak hours. HA restarts the virtual machines on other hosts, but both web servers for the billing application were on the failed host, so billing was down until both restarted.
The operations team adds an anti-affinity rule to separate the web servers, places them behind a load balancer with health checks, and enables predictive hardware alerts that put hosts into maintenance mode before failure. A quarterly restore test of the billing database becomes part of the run book.
How the exam asks about this
- "Which feature moves virtual machines off a host so it can be patched without downtime?" Maintenance mode, with live migration.
- "What restarts virtual machines on other hosts after a host failure?" High availability.
- "Why are snapshots alone not a sufficient backup strategy?" They are usually stored with the original, share its failure and compromise risks, and may not be application consistent.
What to remember for the exam
- DRS places and balances workloads; dynamic optimization rebalances continuously.
- HA restarts virtual machines after host failure; maintenance mode empties a host for planned work.
- Guest availability needs redundant instances, health checks and load balancing.
- Monitor network, compute, storage and response time; anomalies can signal attacks.
- Back up to a separate location, encrypt, make immutable and test restores.
Host HA does not make an application highly available. If all copies run on one host or one zone, a single failure still stops the service.
Common mistakes
Treating snapshots as backups. A snapshot in the same account can be deleted or encrypted by the same attacker.
Monitoring only for performance. Unusual resource use is often the first sign of compromise.
Skipping restore tests. Backups that cannot be restored within the RTO fail exactly when needed.
Check yourself
What is the purpose of anti-affinity rules?
To keep specified virtual machines on different hosts so a single host failure does not take down all of them.
What does maintenance mode do?
It moves running workloads off a host so the host can be patched or repaired without interrupting service.
Why should backups be stored in a separate account?
So that a compromise or mistake in the production account cannot delete or encrypt the backups as well.
Topic 3 of 6 in Cloud Security Operations
Test yourself on Cloud Security Operations
The full ISC2 CCSP question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.