OCI Architect Professional flashcards
OCI Architect Professional · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Explicit deny precedence
- In OCI IAM, any explicit DENY in an applicable policy overrides every ALLOW. If no ALLOW matches the request, access is implicitly denied.
- Policy inheritance direction
- Policies attached at the tenancy root apply to all compartments below. Policies in a child compartment never grant or restrict access in the parent or in sibling compartments.
- manage verb scope
- The manage verb includes inspect, read, use, and create/update/delete. It is the broadest verb and is used when full control of a resource type is intended.
- Dynamic group rule
- A rule matching resource attributes such as instance.compartment.id or resource.type plus tags. Matching instances become members and can be granted access by policy.
- Instance principal authentication
- Instances obtain short-lived certificates from the identity service through the instance metadata service, so no long-lived API key is stored on the host.
- Confidential vs public client
- Confidential clients keep a secret and use the client credentials flow for service-to-service calls. Public clients use authorization code with PKCE for user-facing apps.
- Federation with identity provider
- OCI IAM Identity Domains can federate with a SAML 2.0 identity provider so users authenticate externally and receive OCI sessions mapped to groups.
- Compartment policy path
- The in-clause names a compartment or compartment path. A policy at the root with a path applies to all compartments beneath that path, not to unrelated branches.
- Route rule longest prefix
- Route tables choose the most specific matching destination CIDR. A 0.0.0.0/0 rule applies only when no narrower rule matches the destination address.
- Internet vs NAT gateway
- An internet gateway allows bidirectional traffic with public IPs. A NAT gateway allows only outbound traffic initiated from private instances and returns the responses.
- Service gateway purpose
- A service gateway routes traffic to OCI service endpoints such as Object Storage without leaving the Oracle network, so private subnets reach services without internet exposure.
- Security list vs NSG
- Security lists apply at the subnet level to all VNICs. Network security groups apply at the VNIC level. Both are stateful, and both must permit traffic when both apply.
- Public vs private subnet
- A public subnet has a route to an internet gateway. A private subnet has no such route and typically uses a NAT gateway or service gateway for outbound access.
- DRG hub topology
- A Dynamic Routing Gateway attaches VCNs and on-premises networks. A hub VCN centralizes attachments, and route tables in each VCN control which traffic transits.
- FastConnect virtual circuit
- A private dedicated connection (1 or 10 Gbps per port) mapped to a DRG attachment. Redundant circuits in separate locations provide the higher availability SLA.
- Private DNS view
- A private view is bound to a VCN resolver and answers queries only from that VCN, letting the same zone name resolve differently per VCN.
- Flexible load balancer shape
- A flexible shape sets minimum and maximum bandwidth for the load balancer. Public load balancers need a public subnet; private load balancers are internal only.
- Regional vs AD subnet
- A regional subnet spans all availability domains in the region. An AD-specific subnet exists in one AD, which constrains where instances using it can be launched.
- OCPU to vCPU ratio
- On x86 shapes, one OCPU equals two vCPUs because each core exposes two hyper-threads. Billing and CPU quotas are expressed in OCPUs.
- Flexible shape sizing
- Flexible shapes let you choose OCPU count and memory independently within the shape's limits, so you can right-size instead of taking a fixed shape.
- Preemptible instance tradeoff
- Preemptible instances cost less but can be reclaimed by Oracle at any time. They suit fault-tolerant batch jobs, not stateful production tiers.
- Instance metadata service
- The link-local address 169.254.169.254 serves user data, instance identity, and certificates used by instance principals. It is reachable only from the instance.
- Stop vs terminate behavior
- Stopping an instance preserves its boot volume and allows restart. Terminating deletes the boot volume unless the preserve-boot-volume option is set.
- Instance pool autoscaling
- An instance pool uses a configuration plus a policy that scales on a metric such as CPU, on a schedule, or manually. Pools can span availability domains.
- Availability vs fault domain
- Availability domains are separate data centers within a region. Fault domains are hardware groupings inside one AD. Spreading across ADs gives the stronger isolation.
- Oracle Cloud Agent plugins
- Agents on the instance enable monitoring, management, vulnerability scanning, and bastion plugins. Features report only while the agent is running.
- Custom image creation
- A custom image is captured from a running instance or boot volume, or imported. It is tied to compatible shape families and firmware at launch time.
- Object Storage tiers
- Buckets and objects use Standard, Infrequent Access, Archive, or Auto-Tiering. Lifecycle rules move objects between tiers or delete them by age or prefix.
- Block volume AD scope
- Block volumes exist in one availability domain and attach to instances in that AD. Multi-attach is opt-in and requires a cluster-aware file system.
- Volume performance units
- Block volume performance is set by VPUs per GB or by a performance tier. IOPS and throughput scale with volume size up to the shape's maximum.
- Volume group backup
- A volume group backup captures multiple volumes together for crash consistency. Backups are incremental and can be copied to another region.
- File system mount target
- A mount target sits in a subnet and exports NFSv3. It has one IP per availability domain it serves, and clients mount using that IP.